diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8557547029..93d8705156 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,7 @@
 name: CI
 on: [push, pull_request]
+permissions:
+    contents: read # to fetch code (actions/checkout)
 
 jobs:
     test:
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index 470fee7f9b..683ad26f18 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -2,7 +2,8 @@ name: Transifex
 on:
   push:
     branches: [master, ]
-
+permissions:
+    contents: read # to fetch code (actions/checkout)
 
 jobs:
     Push-To-Transifex: