diff --git a/internal/builders/generic/README.md b/internal/builders/generic/README.md
index 8c27f2264..890fae4c7 100644
--- a/internal/builders/generic/README.md
+++ b/internal/builders/generic/README.md
@@ -67,6 +67,7 @@ jobs:
   provenance:
     needs: [build]
     permissions:
+      actions: read
       id-token: write
       contents: read
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@main