diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 397224dce01..63cc6d26596 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -8,6 +8,9 @@ on:
   pull_request: {}
   workflow_dispatch: {}
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   federation-benchmark:
     name: Federation Benchmark with ${{matrix.products_size}} Products
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acaa427aa74..1c1aa4ddefc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,8 +4,12 @@ on:
     branches:
       - master
 
+permissions: {}
 jobs:
   stable:
+    permissions:
+      contents: write # to create release
+
     uses: the-guild-org/shared-config/.github/workflows/release-stable.yml@main
     with:
       releaseScript: release