diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index b1b869c..3587171 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -17,6 +17,9 @@ on:
       - main
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   cargo-checks:
     name: Task cargo ${{ matrix.action }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4b4bee2..40893b0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,9 +11,14 @@ on:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Publish