diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c39fdc..21d7851 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint YAML
diff --git a/.github/workflows/diff.yml b/.github/workflows/diff.yml
index 47e2169..cca661a 100644
--- a/.github/workflows/diff.yml
+++ b/.github/workflows/diff.yml
@@ -12,6 +12,9 @@ on:
           - staging
           - production
 
+permissions:
+  contents: read
+
 jobs:
   diff:
     runs-on: ubuntu-latest