diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 50d918f..223c6ec 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,37 +1,32 @@
 name: Deploy Application
-
 on:
   push:
     branches:
       - dinura-deployment
   workflow_dispatch:
-
+permissions:
+  contents: read
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '20'
-
       - name: Backend syntax check
         run: |
           python -m compileall integrated-backend
-
       - name: Frontend build
         run: |
           npm ci --prefix integrated-frontend
           npm run build --prefix integrated-frontend
-
   deploy:
     needs: ci
     runs-on: ubuntu-latest
@@ -40,7 +35,6 @@ jobs:
         uses: webfactory/ssh-agent@v0.9.0
         with:
           ssh-private-key: ${{ secrets.EC2_SSH_KEY }}
-
       - name: SSH and deploy latest app
         env:
           EC2_HOST: ${{ secrets.EC2_HOST }}
@@ -53,11 +47,9 @@ jobs:
             git fetch origin
             git checkout dinura-deployment
             git reset --hard origin/dinura-deployment
-
             if [ ! -f .env ]; then
               cp .env.example .env
             fi
-
             chmod 600 .env
             if docker info >/dev/null 2>&1; then
               DOCKER_CMD="docker"
@@ -67,11 +59,9 @@ jobs:
               echo "Docker daemon is not accessible for deployment user"
               exit 1
             fi
-
             $DOCKER_CMD compose build
             $DOCKER_CMD compose up -d
             $DOCKER_CMD compose ps
-
             if curl -fsS http://127.0.0.1/api/health >/dev/null 2>&1; then
               echo "Backend health check passed"
             else
@@ -79,4 +69,4 @@ jobs:
               $DOCKER_CMD compose logs --tail 200 backend
               exit 1
             fi
-          EOF
+          EOF
\ No newline at end of file