diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 21a68e96f..8daa9fb55 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -9,6 +9,9 @@ on:
 env:
     fail-fast: true
 
+permissions:
+    contents: read
+
 jobs:
     php-cs-fixer:
         name: PHP-CS-Fixer
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 6cadcd244..a0740c53d 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -13,6 +13,9 @@ env:
     SYMFONY_REQUIRE: ">=6.0"
     SYMFONY_DEPRECATIONS_HELPER: 7
 
+permissions:
+    contents: read
+
 jobs:
     test:
         name: "${{ matrix.operating-system }} / PHP ${{ matrix.php-version }}"