diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 3b8c6e0..6e6f82e 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -5,6 +5,9 @@
     - cron:  '0 4 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   GOPROXY: https://proxy.golang.org/
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 1ecd786..9bb720f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,6 +6,9 @@
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   GOPROXY: https://proxy.golang.org/