diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b648de9..44c1954 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,10 @@ on:
   release:
     types: [ published, edited ]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   test:
     name: Tests
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e51cbd1..d073d9a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -2,6 +2,10 @@ name: Tests
 
 on: [ push, pull_request_target ]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
 
   test: