diff --git a/.github/workflows/all.yml b/.github/workflows/all.yml
index 5d5afc36..f65281d9 100644
--- a/.github/workflows/all.yml
+++ b/.github/workflows/all.yml
@@ -15,6 +15,10 @@ env:
 
 jobs:
   basics:
+    permissions:
+      contents: read
+      pull-requests: write
+
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72d2727f..9aa0dc16 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,6 @@
 name: Release
+permissions:
+  contents: write # to do releases
 
 on:
   push: