diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 4f51d336f..9c4445e77 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -7,6 +7,9 @@ name: Smoke
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     env:
diff --git a/.github/workflows/unit.yml b/.github/workflows/unit.yml
index 8da4bfe11..8aeb0f907 100644
--- a/.github/workflows/unit.yml
+++ b/.github/workflows/unit.yml
@@ -7,6 +7,9 @@ name: Unit
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     env: