diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
index d65c7dff..15788a30 100644
--- a/.github/workflows/pre-commit.yaml
+++ b/.github/workflows/pre-commit.yaml
@@ -3,6 +3,10 @@ on:
   pull_request:
   push:
     branches: [main, stable]
+
+permissions:
+  contents: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index a69670bb..189f90a6 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -5,6 +5,10 @@ on:
   push:
     branches: [main, stable]
     paths-ignore: ['docs/**', 'README.md']
+
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: ${{ matrix.name || matrix.python }}