diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ea3f97acced3..ab1c81068d12 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: "15 2 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   set_release_type:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/validate-cxx-api-snapshots.yml b/.github/workflows/validate-cxx-api-snapshots.yml
index 4d8230a1e66c..302d45fd9575 100644
--- a/.github/workflows/validate-cxx-api-snapshots.yml
+++ b/.github/workflows/validate-cxx-api-snapshots.yml
@@ -25,6 +25,9 @@ on:
 env:
   DOXYGEN_VERSION: "1.16.1"
 
+permissions:
+  contents: read
+
 jobs:
   validate_cxx_api_snapshots:
     runs-on: ubuntu-latest