diff --git a/README.md b/README.md
index e5d0619..2d4d320 100644
--- a/README.md
+++ b/README.md
@@ -349,7 +349,8 @@ jobs:
     runs-on: ubuntu-latest
     # Required permissions
     permissions:
-      pull-requests: read
+      contents: read      # required by actions/checkout
+      pull-requests: read # required by dorny/paths-filter
     steps:
     - uses: actions/checkout@v6
     - uses: dorny/paths-filter@v4