diff --git a/.github/workflows/gradle_release.yml b/.github/workflows/gradle_release.yml
index da5931624c..1a32ddb249 100644
--- a/.github/workflows/gradle_release.yml
+++ b/.github/workflows/gradle_release.yml
@@ -10,10 +10,15 @@ on:
     tags:
       - 'v3.*.*'   
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     env:
       CI_BUILD_NUMBER: ${{ github.run_number }}
     steps:
diff --git a/.github/workflows/gradle_snapshot.yml b/.github/workflows/gradle_snapshot.yml
index c241705126..8d1be2f111 100644
--- a/.github/workflows/gradle_snapshot.yml
+++ b/.github/workflows/gradle_snapshot.yml
@@ -6,12 +6,17 @@ name: Snapshot
 on:
   push:
     branches: [ '3.x' ]
+    
+permissions:
+  contents: read
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
     if: github.repository == 'ReactiveX/RxJava'
+    permissions:
+      contents: write
     env:
       # ------------------------------------------------------------------------------ 
       CI_BUILD_NUMBER: ${{ github.run_number }}