diff --git a/crates/automation/src/confine.rs b/crates/automation/src/confine.rs
index 0e9d79d4b..d3c27dfb8 100644
--- a/crates/automation/src/confine.rs
+++ b/crates/automation/src/confine.rs
@@ -88,6 +88,8 @@ const READS: &[(&str, &[&str])] = &[
     ("mediaBrowser.removeFavorite", &["path"]),
     ("face.model.install", &["path"]),
     ("roto.model.install", &["path"]),
+    // Looks up what the file at `path` is (writable roots are readable too).
+    ("file.checkOutput", &["path"]),
     // Reads the template at `path`; what it writes is in `MIXED_WRITES`.
     ("templates.create", &["path"]),
 ];