diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ea6e0f5a60..db8a5dc1c9 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -7,8 +7,12 @@ on:
     paths:
       - site/content/**
 
+permissions: {}
 jobs:
   release:
+    permissions:
+      metadata: read #  (getsentry/action-github-app-token)
+
     name: Deploy docs
     runs-on: ubuntu-latest
     steps: