diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7f26681..1aa8598 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -5,6 +5,8 @@ on:
       - master
       - 'release/**'
   pull_request:
+permissions:
+  contents: read
 jobs:
   main:
     strategy:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae23d54..8ef7098 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,8 @@ on:
     tags:
     - 'v*'
     - 'test-action-release-*'
+permissions:
+  contents: read
 jobs:
   release:
     strategy:
@@ -12,6 +14,10 @@ jobs:
         os: [ubuntu-24.04]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
+    permissions:
+      contents: write  # for releases
+      id-token: write  # for provenances
+      attestations: write  # for provenances
     steps:
     - uses: actions/checkout@v7
       with: