diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml
index 9b0c2bcd..f511cd20 100644
--- a/.github/workflows/ansible-lint.yml
+++ b/.github/workflows/ansible-lint.yml
@@ -1,5 +1,7 @@
 ---
 name: Ansible lint
+permissions:
+  contents: read
 
 "on":
   push:
diff --git a/.github/workflows/check-yaml-syntax.yml b/.github/workflows/check-yaml-syntax.yml
index c61dd341..e9c614ce 100644
--- a/.github/workflows/check-yaml-syntax.yml
+++ b/.github/workflows/check-yaml-syntax.yml
@@ -1,5 +1,7 @@
 ---
 name: Check yaml syntax
+permissions:
+  contents: read
 
 "on":
   push: