diff --git a/.github/workflows/build-desktop.yml b/.github/workflows/build-desktop.yml
index f9f4e3abd..563c54fe7 100644
--- a/.github/workflows/build-desktop.yml
+++ b/.github/workflows/build-desktop.yml
@@ -13,6 +13,9 @@
 name: Build Desktop (reusable)
 on:
   workflow_call:
+permissions:
+  contents: read
+  actions: write
     inputs:
       build_ref:
         description: Git ref to check out for the build (tag or SHA).