diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 06b80f283..cb9ba9602 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -5,6 +5,8 @@ name: Crubit Nightly Test Matrix
 on:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   use-test-matrix:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 0a3f4de84..0a50a786b 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -12,6 +12,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 # LINT.IfChange
 jobs:
   test: