diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97fcfe7545..32c78813eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,9 @@ on:
   pull_request: {}
   workflow_call: {}
 
+permissions:
+  contents: read
+
 env:
   # Keep this Bazel version in sync with the `versions.check` directive
   # in our WORKSPACE file.
diff --git a/.github/workflows/nightly-release.yml b/.github/workflows/nightly-release.yml
index ef57db220f..88285986a0 100644
--- a/.github/workflows/nightly-release.yml
+++ b/.github/workflows/nightly-release.yml
@@ -7,6 +7,9 @@ on:
     # (cron syntax: minute hour day-of-month month day-of-week)
     - cron: '0 11 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml