diff --git a/.github/workflows/shared/apm.md b/.github/workflows/shared/apm.md
index 9da9e66d112..cd875eb3360 100644
--- a/.github/workflows/shared/apm.md
+++ b/.github/workflows/shared/apm.md
@@ -32,7 +32,8 @@ jobs:
   apm:
     runs-on: ubuntu-slim
     needs: [activation]
-    permissions: {}
+    permissions:
+      contents: read
     steps:
       - name: Checkout workflow lock files
         uses: actions/checkout@v6.0.2
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 7999dcb55c1..3806393d1d0 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -2486,7 +2486,7 @@ jobs:
     needs: activation
     runs-on: ubuntu-slim
     permissions:
-      {}
+      contents: read
 
     steps:
       - name: Configure GH_HOST for enterprise compatibility