diff --git a/.github/workflows/api-docs.yml b/.github/workflows/api-docs.yml
index dc2e0634..063fb0f5 100644
--- a/.github/workflows/api-docs.yml
+++ b/.github/workflows/api-docs.yml
@@ -1,4 +1,7 @@
 name: deploy-api-docs
+
+permissions:
+  contents: read
 on:
   push:
     branches:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 926f2fbe..6a491e60 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,7 @@
 name: CI
+
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true