diff --git a/.github/chainguard/autofix.sts.yaml b/.github/chainguard/autofix.sts.yaml
index 4e8f57a..d1be243 100644
--- a/.github/chainguard/autofix.sts.yaml
+++ b/.github/chainguard/autofix.sts.yaml
@@ -3,6 +3,7 @@ issuer: https://accounts.google.com
 subject: "114301252256317020592"
 
 permissions:
+  actions: read
   checks: write
   contents: write
   pull_requests: read