diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 69d7f28..6541605 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8365d04..f5b4549 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,5 +1,7 @@
 # Lint workflow: shellcheck, shfmt, and standards verification for all shell scripts.
 name: Lint
+permissions:
+  contents: read
 
 on:
   push: