diff --git a/.github/workflows/apidoc.yml b/.github/workflows/apidoc.yml
index ae3d7b5e6..5594b8b69 100644
--- a/.github/workflows/apidoc.yml
+++ b/.github/workflows/apidoc.yml
@@ -17,12 +17,11 @@ defaults:
     # to improve debugging some of the longer scripts.
     shell: /bin/bash -o errexit -o pipefail -o xtrace {0}
 
-permissions: {}
+permissions:
+  contents: read
+
 jobs:
   main:
-    permissions:
-      contents: write # for git push
-
     runs-on: ubuntu-20.04
 
     env: