diff --git a/.github/workflows/bump-dependency.yaml b/.github/workflows/bump-dependency.yaml
index 03174f149d..cf799d2d15 100644
--- a/.github/workflows/bump-dependency.yaml
+++ b/.github/workflows/bump-dependency.yaml
@@ -1,5 +1,10 @@
 name: Bump Deps
 
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
 on:
   repository_dispatch:
     types: [ bump-dependency ]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 913844ec1c..f7f1e27e1a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,5 +1,7 @@
 name: Test
 on: [pull_request]
+permissions:
+  contents: read
 
 concurrency:
   group: test-${{ github.event.pull_request.number || github.ref }}