diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 50e00f9c9..57a1e3833 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -14,6 +14,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   tests:
     name: Run tests
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index b2219893d..999cc08e2 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -9,6 +9,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
 jobs:
   add-to-project:
     name: Add to project