diff --git a/.github/workflows/sec-sync-bundle-branches.yml b/.github/workflows/sec-sync-bundle-branches.yml
index 720b80b6f33..04d14f5d46e 100644
--- a/.github/workflows/sec-sync-bundle-branches.yml
+++ b/.github/workflows/sec-sync-bundle-branches.yml
@@ -100,6 +100,7 @@ jobs:
     needs: [sync]
     if: ${{ !cancelled() && needs.sync.result != 'skipped' }}
     permissions:
+      contents: read # read the bundle branch ref
       pull-requests: write
     uses: ./.github/workflows/sec-sync-retarget-prs.yml