diff --git a/.github/workflows/opentelemetry.yml b/.github/workflows/opentelemetry.yml
index 79e316418..1eb6d8ad4 100644
--- a/.github/workflows/opentelemetry.yml
+++ b/.github/workflows/opentelemetry.yml
@@ -1,17 +1,21 @@
 ---
-  name: OpenTelemetry Export Trace
+name: OpenTelemetry Export Trace
 
-  on:
-    workflow_run:
-      workflows: ["*"]
-      types: [completed]
+on:
+  workflow_run:
+    workflows:
+      - "*"
+    types: [completed]
 
-  jobs:
-    otel-export-trace:
-      runs-on: ubuntu-latest
-      steps:
-        - uses: elastic/apm-pipeline-library/.github/actions/opentelemetry@current
-          with:
-            vaultUrl: ${{ secrets.VAULT_ADDR }}
-            vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
-            vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
+permissions:
+  contents: read
+
+jobs:
+  otel-export-trace:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: elastic/apm-pipeline-library/.github/actions/opentelemetry@current
+        with:
+          vaultUrl: ${{ secrets.VAULT_ADDR }}
+          vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
+          vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}