diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b5d3a61..977b958 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,9 @@ on:
     # Sequence of patterns matched against refs/tags
     tags:
       - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 26fd0a5..3e98871 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,6 +7,9 @@ on:
       - dev
   schedule:
     - cron: '0 0 * * *'
+permissions:
+  contents: read
+
 jobs:
   test:
     env: