diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index c96a48f..baeda4f 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -9,6 +9,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     strategy:
       matrix:
         node-version: [18.x, 20.x, 22.x]
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1072997..a5631cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     strategy:
       matrix:
         node-version: [18.x, 20.x, 22.x]
@@ -32,6 +35,10 @@ jobs:
   publish-npm:
     needs: test
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v1