diff --git a/.github/workflows/mlx.yml b/.github/workflows/mlx.yml
index 1e5839c7789..38914f7612b 100644
--- a/.github/workflows/mlx.yml
+++ b/.github/workflows/mlx.yml
@@ -22,7 +22,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.event_name == 'workflow_dispatch' }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   # Emits is-full-run='true' for workflow_dispatch / ciflow tag /
diff --git a/.github/workflows/viable-strict-gate.yml b/.github/workflows/viable-strict-gate.yml
index 38beb4cf0fc..d25b57803b9 100644
--- a/.github/workflows/viable-strict-gate.yml
+++ b/.github/workflows/viable-strict-gate.yml
@@ -25,7 +25,8 @@ on:
     tags:
       - ciflow/trunk/*
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   run-decision: