diff --git a/.github/workflows/benchmark-action.yml b/.github/workflows/benchmark-action.yml
index 97d129d366..4ee2096e17 100644
--- a/.github/workflows/benchmark-action.yml
+++ b/.github/workflows/benchmark-action.yml
@@ -8,13 +8,13 @@ on:
       - src/client/Microsoft.Identity.Client/**/*.cs
 
 permissions:
-  # Deployments permission to deploy GitHub pages website
-  deployments: write
   # Contents permission to update benchmark contents in gh-pages branch
-  contents: write
+  contents: read
 
 jobs:
   benchmark:
+    permissions:
+      contents: write  # Elevate permissions specifically for this job
     name: Run performance benchmarks
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/trigger_onebranch_ci.yml b/.github/workflows/trigger_onebranch_ci.yml
index ca95a4577d..bf2da43377 100644
--- a/.github/workflows/trigger_onebranch_ci.yml
+++ b/.github/workflows/trigger_onebranch_ci.yml
@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
     build:
         name: Call OneBranch ADO Pipeline (CI)