diff --git a/README.md b/README.md
index 1ca9aea..eac12d8 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,7 @@ permissions:
   pull-requests: write
   issues: write
   checks: read
+  contents: read # useful if your workflows call actions/checkout@vX.X.X
 
 jobs:
   demo: