diff --git a/.github/workflows/weekly-cargo-update.yml b/.github/workflows/weekly-cargo-update.yml
index 45486d7c..da295c48 100644
--- a/.github/workflows/weekly-cargo-update.yml
+++ b/.github/workflows/weekly-cargo-update.yml
@@ -8,6 +8,9 @@ on:
 env:
   RUST_TOOLCHAIN: 1.88.0
 
+permissions:
+  contents: read
+
 jobs:
   update:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/weekly-collateral-update.yml b/.github/workflows/weekly-collateral-update.yml
index ffaf6db7..2d2f8cfa 100644
--- a/.github/workflows/weekly-collateral-update.yml
+++ b/.github/workflows/weekly-collateral-update.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 0 * * 1' # Every Monday at 00:00 UTC
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   generate-collateral-policy:
     runs-on: ubuntu-latest