diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 5a11018..26e8c00 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -12,6 +12,9 @@ concurrency:
   group: check-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: test ${{ matrix.env }} - ${{ matrix.os }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ae50f9b..db6b227 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,6 +3,9 @@ on:
   push:
     tags: ["*"]
 
+permissions:
+  contents: read
+
 env:
   dists-artifact-name: python-package-distributions