diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5942d2c1..aa8627c3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,6 +51,7 @@ jobs:
       contents: read
       pull-requests: write # for gh pr edit --add-assignee
       repository-projects: read # for gh pr edit --add-assignee
+      security-events: write # for github/codeql-action/*
     secrets: inherit
 
   test: