diff --git a/.github/workflows/community-label.yml b/.github/workflows/community-label.yml
index ba5637da4cb..3b75a3c14e7 100644
--- a/.github/workflows/community-label.yml
+++ b/.github/workflows/community-label.yml
@@ -21,6 +21,7 @@ defaults:
 
 permissions:
     pull-requests: write # labels PRs
+    contents: read # reads team membership
 
 jobs:
   open_issues: