diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e44de93..1a704639 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,8 @@
 # This starter workflow is for a CMake project running on multiple platforms. There is a different starter workflow if you just want a single platform.
 # See: https://github.com/actions/starter-workflows/blob/main/ci/cmake-single-platform.yml
 name: CI
+permissions:
+  contents: read
 
 on:
   push:
diff --git a/.github/workflows/clang-format-check.yml b/.github/workflows/clang-format-check.yml
index 1b137060..b0e460cb 100644
--- a/.github/workflows/clang-format-check.yml
+++ b/.github/workflows/clang-format-check.yml
@@ -1,4 +1,7 @@
 name: clang-format Check
+permissions:
+  contents: read
+
 on: [push, pull_request]
 jobs:
   formatting-check: