diff --git a/.github/workflows/on-merge.yml b/.github/workflows/on-merge.yml
index cdad518a..cf1da016 100644
--- a/.github/workflows/on-merge.yml
+++ b/.github/workflows/on-merge.yml
@@ -12,6 +12,9 @@ on:
       - "**"
 
 permissions:
+  actions: read
+  checks: write
+  contents: read
   id-token: write
 
 concurrency:
diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml
index b5ae1d1a..af033a12 100644
--- a/.github/workflows/on-release.yml
+++ b/.github/workflows/on-release.yml
@@ -7,6 +7,9 @@ on:
     types: [published]
 
 permissions:
+  actions: read
+  checks: write
+  contents: read
   id-token: write
 
 jobs: