diff --git a/.github/workflows/add-new-team-label.yml b/.github/workflows/add-new-team-label.yml
index e9f103045b..017e2ecba5 100644
--- a/.github/workflows/add-new-team-label.yml
+++ b/.github/workflows/add-new-team-label.yml
@@ -4,6 +4,9 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   add-needs-triage-label:
     name: Add `needs-team` label
diff --git a/.github/workflows/co-docs-builder.yml b/.github/workflows/co-docs-builder.yml
index f6f4f8d490..e1986baa35 100644
--- a/.github/workflows/co-docs-builder.yml
+++ b/.github/workflows/co-docs-builder.yml
@@ -18,6 +18,9 @@ on:
       - '**.gif'
     types: [closed, opened, synchronize, labeled]
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     if: contains(github.event.pull_request.labels.*.name, 'ci:doc-build')