diff --git a/.github/workflows/upload-to-r2.yml b/.github/workflows/upload-to-r2.yml
index 4425793e..9a0131b2 100644
--- a/.github/workflows/upload-to-r2.yml
+++ b/.github/workflows/upload-to-r2.yml
@@ -14,7 +14,8 @@ on:
         required: true
         type: string
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   upload-to-r2: