diff --git a/.github/workflows/ghaction-github-labeler.yaml b/.github/workflows/ghaction-github-labeler.yaml
index d871570..ab43b7d 100644
--- a/.github/workflows/ghaction-github-labeler.yaml
+++ b/.github/workflows/ghaction-github-labeler.yaml
@@ -11,14 +11,12 @@ permissions:
 
 jobs:
   labeler:
-    permissions:
-      contents: read  # for actions/checkout to fetch code
-      issues: write  # for crazy-max/ghaction-github-labeler to create, rename, update and delete label
     name: Labeler
     if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
+      issues: write  # for crazy-max/ghaction-github-labeler to create, rename, update and delete label
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2