diff --git a/.github/workflows/trivy-nightly-scan.yaml b/.github/workflows/trivy-nightly-scan.yaml
index af376f5f7..62fb4d0dd 100644
--- a/.github/workflows/trivy-nightly-scan.yaml
+++ b/.github/workflows/trivy-nightly-scan.yaml
@@ -3,6 +3,7 @@ on:
   schedule:
     - cron: '0 2 * * *' # run at 2 AM UTC
 
+permissions: read-all 
 jobs:
   nightly-scan:
     name: Trivy Scan nightly