diff --git a/.github/workflows/ci-site.yml b/.github/workflows/ci-site.yml
index 89d12e0745..9b9388e0a6 100644
--- a/.github/workflows/ci-site.yml
+++ b/.github/workflows/ci-site.yml
@@ -135,6 +135,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: merge
     if: github.ref == 'refs/heads/master' || github.event_name == 'release'
+    permissions: {} # only calls an external URL via curl, no GitHub API access needed
 
     steps:
       - name: trigger deployment
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 4ccb6ba98f..1f239c6ad2 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -206,6 +206,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: merge
     if: github.event.workflow_run.head_branch == 'master'
+    permissions: {} # only calls an external URL via curl, no GitHub API access needed
 
     steps:
       - name: trigger deployment