diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 408e3a0..e5f96d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,6 +42,7 @@ jobs:
     needs: change-detection
     permissions:
       id-token: write # Explicitly allows the `id-token: write` permission for this job
+      contents: read
     if: fromJSON(needs.change-detection.outputs.run-python-tests)
     uses: cda-tum/mqt-workflows/.github/workflows/reusable-python-ci.yml@v1.5.0