diff --git a/.github/workflows/buildtest.yaml b/.github/workflows/buildtest.yaml
index 87fe86b7d..396f0d343 100644
--- a/.github/workflows/buildtest.yaml
+++ b/.github/workflows/buildtest.yaml
@@ -21,6 +21,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read # Lint and test only read the checkout
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/generate.yaml b/.github/workflows/generate.yaml
index a645ad528..976508793 100644
--- a/.github/workflows/generate.yaml
+++ b/.github/workflows/generate.yaml
@@ -19,6 +19,9 @@ on:
   push:
     branches-ignore: [main]
 
+permissions:
+  contents: write # Required to commit the regenerated output
+
 jobs:
   generate:
     runs-on: ubuntu-latest