diff --git a/.github/workflows/deploy-embed-test.yml b/.github/workflows/deploy-embed-test.yml
index 2b67e4323..b08d2f9de 100644
--- a/.github/workflows/deploy-embed-test.yml
+++ b/.github/workflows/deploy-embed-test.yml
@@ -1,5 +1,8 @@
 name: 'Deploy embed test'
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
diff --git a/.github/workflows/test-and-deploy.yml b/.github/workflows/test-and-deploy.yml
index 378ffd252..c37e606a3 100644
--- a/.github/workflows/test-and-deploy.yml
+++ b/.github/workflows/test-and-deploy.yml
@@ -1,5 +1,8 @@
 name: 'Test and deploy'
 
+permissions:
+  contents: read
+
 env: # Keep this in sync with Dockerfile version, Krypton (== 24)
   NODE_VERSION: "lts/Krypton"
 
@@ -100,6 +103,8 @@ jobs:
   event_file:
     name: "Event File"
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
     steps:
       - name: 'Upload'
         uses: actions/upload-artifact@v6