diff --git a/.github/workflows/external-plugin-pr-quality-gates.yml b/.github/workflows/external-plugin-pr-quality-gates.yml
index 4bd3105a..0fcb1074 100644
--- a/.github/workflows/external-plugin-pr-quality-gates.yml
+++ b/.github/workflows/external-plugin-pr-quality-gates.yml
@@ -112,9 +112,9 @@ jobs:
     needs: [detect-changed-plugins, run-quality-gates]
     if: always()
     permissions:
+      contents: read
       issues: write
       pull-requests: write
-    steps:
       - name: Checkout staged branch
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with: