diff --git a/.github/workflows/validate-basecoat.yml b/.github/workflows/validate-basecoat.yml
index 39b7bfd..d39ef4f 100644
--- a/.github/workflows/validate-basecoat.yml
+++ b/.github/workflows/validate-basecoat.yml
@@ -8,6 +8,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   validate-commit-messages:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/validate-repo-template-sample.yml b/.github/workflows/validate-repo-template-sample.yml
index b1254b1..e4e505a 100644
--- a/.github/workflows/validate-repo-template-sample.yml
+++ b/.github/workflows/validate-repo-template-sample.yml
@@ -7,6 +7,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   validate-sample-template:
     runs-on: ubuntu-latest