diff --git a/.github/workflows/check_dependent.yaml b/.github/workflows/check_dependent.yaml
index 220a1da286bf..65fc3e8de421 100644
--- a/.github/workflows/check_dependent.yaml
+++ b/.github/workflows/check_dependent.yaml
@@ -7,6 +7,10 @@ on:
   pull_request_target:
     types: [opened, synchronize, labeled, unlabeled]
 
+# This workflow runs as `pull_request_target` so that the check can't be
+# disabled or bypassed by the PR, but it doesn't need any permissions.
+permissions: {}
+
 jobs:
   check_label:
     runs-on: ubuntu-latest