diff --git a/build/fbcode_builder/getdeps.py b/build/fbcode_builder/getdeps.py
index 7f43c91bd..b6ea1aa2c 100755
--- a/build/fbcode_builder/getdeps.py
+++ b/build/fbcode_builder/getdeps.py
@@ -988,6 +988,9 @@ def write_job_for_platform(self, platform, args):  # noqa: C901
 
 on:{run_on}
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
 """
             )