diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a4f58aa..013e28d6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,10 @@ on: [pull_request]
 jobs:
   preview:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/volume=80gb/spot=false"
+    permissions:
+      contents: read
+      actions: read         # dawidd6/action-download-artifact reads the cache.yml build artifact
+      pull-requests: write
     steps:
       - uses: actions/checkout@v7
         with: