diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f99fd27a..89d605f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,9 @@ on:
       - "**"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build-release:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/test-docs.yml b/.github/workflows/test-docs.yml
index 610347fe..04b086a0 100644
--- a/.github/workflows/test-docs.yml
+++ b/.github/workflows/test-docs.yml
@@ -29,6 +29,9 @@ on:
       - "**"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   # UTF-8 content may be interpreted as ascii and causes errors without this.
   LANG: C.UTF-8