diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 9945216..f937aaa 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -12,6 +12,12 @@ on:
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      # rustsec/audit-check reports advisories as a check run on push/PR and
+      # opens issues on the scheduled run.
+      checks: write
+      contents: read
+      issues: write
     # cargo-audit's dependency tree can require a newer rustc than this repo's
     # pinned rust-toolchain.toml (used to build the actual crate). Override
     # with the runner's default stable toolchain just for this job so
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e50da77..355b537 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check
@@ -55,6 +58,8 @@ jobs:
 
   release:
     runs-on: macos-latest
+    permissions:
+      contents: write
     needs:
       - test
       - lints
@@ -101,6 +106,8 @@ jobs:
   upload-mac-universal-bin:
     needs: release
     runs-on: macos-latest
+    permissions:
+      contents: write
     if: ${{needs.release.outputs.new_version}}
     steps:
       - uses: actions/checkout@v4
@@ -126,6 +133,8 @@ jobs:
     needs: release
     if: ${{needs.release.outputs.new_version}}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - name: Update local toolchain
@@ -153,6 +162,8 @@ jobs:
       - upload-mac-universal-bin
     if: success() && ${{needs.release.outputs.new_version}}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - uses: facebook/dotslash-publish-release@v1