diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 166b52ae..a1564c4a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,6 +24,10 @@ on:
       # GitHub codeowners
       - '.github/CODEOWNERS'
 
+
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/validate-changelog.yml b/.github/workflows/validate-changelog.yml
index 70315c19..d638df83 100644
--- a/.github/workflows/validate-changelog.yml
+++ b/.github/workflows/validate-changelog.yml
@@ -5,6 +5,10 @@ on:
     paths:
       - 'CHANGELOG.md'
 
+
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest