diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index fb00a7b8..b730264b 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -6,6 +6,9 @@ on:
       - '**'
   workflow_call:
 
+permissions:
+  contents: write
+
 concurrency:
   group: ${{ github.workflow }}${{ github.ref_name != github.event.repository.default_branch && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.ref_name != github.event.repository.default_branch }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2e01b77f..1d5da543 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+
 jobs:
   check:
     uses: ./.github/workflows/check.yml