diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 58ca643..a71d3ca 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -27,7 +27,8 @@ on:
       - 'examples/**'
       - '.github/workflows/e2e.yml'
   workflow_dispatch:
-permissions: read-all
+permissions:
+  contents: read
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 97d9d9d..d89fb86 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,15 +5,16 @@ on:
   push:
     branches: [main, master]
   workflow_dispatch:
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+# Permissions are declared per job rather than at workflow level, so the build
+# job never holds the pages/id-token write scopes that only the deploy job
+# needs.
 concurrency:
   group: "pages"
   cancel-in-progress: false
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     timeout-minutes: 15
     container:
@@ -43,6 +44,10 @@ jobs:
         with:
           path: '_site'
   deploy:
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}