diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9be802..b6fe21d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   push:
     branches: ["master"]
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     name: Build
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a36aea7..2f73dab 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: "0 8 * * 1"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "Build"