diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 94e6e000..ceb608e2 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -17,6 +17,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   REPORTS_DIR: CI_reports
   PYTHON_VERSION_DEFAULT: "3.11"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f56f252..b059ca64 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,8 @@ concurrency:
   group: deploy
   cancel-in-progress: false  # prevent hickups with semantic-release
 
+permissions: {}
+
 env:
   PYTHON_VERSION_DEFAULT: "3.11"
   POETRY_VERSION: "1.8.1"