diff --git a/.github/workflows/has_changelog.yaml b/.github/workflows/has_changelog.yaml
index 3021a8cf..99263bed 100644
--- a/.github/workflows/has_changelog.yaml
+++ b/.github/workflows/has_changelog.yaml
@@ -9,6 +9,9 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   check_has_news_in_changelog_dir:
     if: |
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 591ebbf0..5f6712be 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '0 4 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: "${{ matrix.name }}"