diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index eed92317..1c3b7694 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -6,6 +6,9 @@ on:
   push:
     branches: ["master", "main", "v3"]
 
+
+permissions:
+  contents: read
 jobs:
   gradle:
     runs-on:  ubuntu-latest
diff --git a/.github/workflows/sca_scan.yml b/.github/workflows/sca_scan.yml
index 86239c07..7dddb310 100644
--- a/.github/workflows/sca_scan.yml
+++ b/.github/workflows/sca_scan.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["master"]
 
+
+permissions:
+  contents: read
 jobs:
   snyk-cli:
     uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@main