diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 775d8f782..50f23f9a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,9 @@ on:
 env:
     SYMFONY_PHPUNIT_DISABLE_RESULT_CACHE: 1
 
+permissions:
+  contents: read
+
 jobs:
     tests:
         name: "PHP ${{ matrix.php-version }}"
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 0b3ca7159..e6a2270f5 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -6,6 +6,9 @@ on:
         branches:
             - '3.x'
 
+permissions:
+  contents: read
+
 jobs:
     build:
         name: "Build"