diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index c23bc5d..13d792c 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -4,7 +4,10 @@ name: Render
 
 on:
   workflow_dispatch:
-  pull_request_target:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   render: