diff --git a/.github/workflows/mypy_primer.yml b/.github/workflows/mypy_primer.yml
index ec7a771a9..af42b94f6 100644
--- a/.github/workflows/mypy_primer.yml
+++ b/.github/workflows/mypy_primer.yml
@@ -8,13 +8,12 @@ on:
     paths:
     - 'stdlib/**'
 
-permissions:
-  contents: read
-
 jobs:
   mypy_primer:
     name: Run
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         shard-index: [0, 1]
@@ -64,6 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: mypy_primer
     permissions:
+      contents: read
       pull-requests: write
     steps:
       - name: Download diffs