diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 64a03019..5bac9383 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,6 +1,8 @@
 ---
 name: CI
 
+permissions: {}
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/pypi-package.yml b/.github/workflows/pypi-package.yml
index 9395b82a..edb07060 100644
--- a/.github/workflows/pypi-package.yml
+++ b/.github/workflows/pypi-package.yml
@@ -1,6 +1,8 @@
 ---
 name: Build & maybe upload PyPI package
 
+permissions: {}
+
 on:
   push:
     branches: [main]