diff --git a/.github/workflows/release-notes.yaml b/.github/workflows/release-notes.yaml
index 731248eac..445b9cd3c 100644
--- a/.github/workflows/release-notes.yaml
+++ b/.github/workflows/release-notes.yaml
@@ -27,6 +27,9 @@ on:
       end-sha:
         description: 'Ending SHA? (latest HEAD)'
 
+permissions:
+  contents: read
+
 jobs:
   release-notes:
     name: Release Notes
diff --git a/.github/workflows/verify.yaml b/.github/workflows/verify.yaml
index d2c384cc4..d921de575 100644
--- a/.github/workflows/verify.yaml
+++ b/.github/workflows/verify.yaml
@@ -1,5 +1,8 @@
 name: verify
 on: [push, pull_request]
+permissions:
+  contents: read
+
 jobs:
   verify:
     name: verify