diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a1260daae..07de33b97 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,6 +11,18 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  actions: none
+  checks: none
+  contents: read
+  deployments: none
+  issues: none
+  packages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+
 jobs:
   lint:
     name: Lint
diff --git a/.github/workflows/preview.yaml b/.github/workflows/preview.yaml
index 31821fa55..54eb0fb76 100644
--- a/.github/workflows/preview.yaml
+++ b/.github/workflows/preview.yaml
@@ -5,6 +5,18 @@ on:
     branches:
       - main
 
+permissions:
+  actions: none
+  checks: none
+  contents: read
+  deployments: none
+  issues: none
+  packages: none
+  pull-requests: write
+  repository-projects: none
+  security-events: none
+  statuses: none
+
 jobs:
   preview:
     name: Preview