diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a93838093..8ba81bb01 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,6 +10,8 @@ on:
       - main
       - release-*
   pull_request:
+permissions:
+  contents: read
 
 env:
   # Don't ignore C warnings. Note that the output of "go env CGO_CFLAGS" by default is "-g -O2", so we keep them.
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index afd916f84..42846b912 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -9,10 +9,15 @@ on:
   pull_request:
 env:
   GO_VERSION: 1.18.x
+permissions:
+  contents: read
 
 jobs:
 
   lint:
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v3
@@ -127,6 +132,9 @@ jobs:
 
 
   commit:
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-20.04
     # Only check commits on pull requests.
     if: github.event_name == 'pull_request'