diff --git a/.github/workflows/lint-openapi.yml b/.github/workflows/lint-openapi.yml
index 3c6072d8..817e94b9 100644
--- a/.github/workflows/lint-openapi.yml
+++ b/.github/workflows/lint-openapi.yml
@@ -1,13 +1,15 @@
 name: API linting
 
-# Run on pull requests or pushes when there is a change to the OpenAPI file
+# Run on pull requests or pushes when there is a change to any OpenAPI files in docs/
 on:
+  pull_request:
   push:
     paths:
-      - docs/
-  pull_request:
-    paths:
-      - docs/
+      - 'docs/**'
+
+# This action only needs read permissions
+permissions:
+  contents: read
 
 jobs:
   build: