diff --git a/.github/workflows/publish_layer.yml b/.github/workflows/publish_layer.yml
index 59d9e364f3..ae60cfaed9 100644
--- a/.github/workflows/publish_layer.yml
+++ b/.github/workflows/publish_layer.yml
@@ -57,6 +57,7 @@ jobs:
     uses: ./.github/workflows/reusable_deploy_layer_stack.yml
     permissions:
       id-token: write
+      contents: read
     with:
       stage: "BETA"
       artifact-name: "cdk-layer-artifact"
@@ -71,6 +72,7 @@ jobs:
     uses: ./.github/workflows/reusable_deploy_layer_stack.yml
     permissions:
       id-token: write
+      contents: read
     with:
       stage: "PROD"
       artifact-name: "cdk-layer-artifact"