diff --git a/.github/workflows/bootstrap_region.yml b/.github/workflows/bootstrap_region.yml
index a9d7db8bcd..4670db9b8e 100644
--- a/.github/workflows/bootstrap_region.yml
+++ b/.github/workflows/bootstrap_region.yml
@@ -38,6 +38,7 @@ jobs:
     name: Bootstrap Region
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       id-token: write
     environment: layer-${{ inputs.environment }}
     steps:
@@ -74,6 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: bootstrap
     permissions:
+      contents: read
       id-token: write
     environment: layer-${{ inputs.environment }}
     steps: