diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 2857912..7334c57 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -15,6 +15,12 @@ on:
   pull_request:
     branches: [main]
 
+# dorny/paths-filter reads the PR file list from the GitHub API; the default token
+# scope is too narrow without pull-requests:read ("Resource not accessible by integration").
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     runs-on: ubuntu-latest