diff --git a/.github/workflows/cron.update.yml b/.github/workflows/cron.update.yml
index 77b9614..14f9a3d 100644
--- a/.github/workflows/cron.update.yml
+++ b/.github/workflows/cron.update.yml
@@ -7,7 +7,17 @@ on:
 jobs:
   cron-update:
     runs-on: ubuntu-latest
+
+    permissions:
+      actions: read
+      contents: write
+
     steps:
+      - name: init / checkout
+        uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
+        with:
+          ref: 'master'
+
       - name: cron-update / get latest version
         uses: actions/github-script@62c3794a3eb6788d9a2a72b219504732c0c9a298
         with: