diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43daefc..f9cad5f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check:
     strategy:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 401ecf6..94d4021 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,7 +6,7 @@ on:
       - "v[0-9]+.*"
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build:
@@ -80,6 +80,8 @@ jobs:
   release:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4