diff --git a/.github/workflows/java_build_test.yml b/.github/workflows/java_build_test.yml
index 4491956..fc15ecf 100644
--- a/.github/workflows/java_build_test.yml
+++ b/.github/workflows/java_build_test.yml
@@ -10,4 +10,9 @@ on:
 
 jobs:
   build:
+    # the reusable workflow publishes the JUnit results as a check run; a called
+    # workflow cannot widen the caller's token, so the scope is granted here
+    permissions:
+      contents: read
+      checks: write
     uses: eclipse-daanse/.github/.github/workflows/reuse_java_build_test.yml@main