diff --git a/template/.github/workflows/book.yml.jinja b/template/.github/workflows/book.yml.jinja
index 5490e9e..27d4ddb 100644
--- a/template/.github/workflows/book.yml.jinja
+++ b/template/.github/workflows/book.yml.jinja
@@ -3,6 +3,9 @@ name: "book"
 on:
 - push
 
+permissions:
+  checks: write
+  contents: read
 
 jobs:
   marimo: