diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
index 56b465cb..7de30760 100644
--- a/.github/workflows/cla-check.yml
+++ b/.github/workflows/cla-check.yml
@@ -5,6 +5,10 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   cla-check:
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b060ba18..42b1ccc4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@
 
 * `docs/Makefile` [#605](https://github.com/canonical/sphinx-stack/pull/605)
 * `README.md` [#603](https://github.com/canonical/sphinx-stack/pull/603)
+* `.github/workflows/cla-check.yml` [#606](https://github.com/canonical/sphinx-stack/pull/606)
 
 ## 2.0