diff --git a/.github/workflows/production_pipeline.yml b/.github/workflows/production_pipeline.yml
index c2f673eac..6fc1c3b96 100644
--- a/.github/workflows/production_pipeline.yml
+++ b/.github/workflows/production_pipeline.yml
@@ -24,6 +24,8 @@ jobs:
   sbom:
     name: Upload SBOM
     needs: [aws_deploy]
+    permissions:
+      contents: read
     uses: ./.github/workflows/upload-sbom.yml
     with:
       projectversion: prod