diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index deabbc6dc78..56b194771b1 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "0 10 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: github.repository == 'nodejs/undici'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9cebbb20bef..530a10cbb57 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test with Node.js ${{ inputs.node-version }} on ${{ inputs.runs-on }}