diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d11e256..67e6881 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,9 @@ name: Build
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   build-matrix:
     strategy:
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 25a2571..1acd9cc 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -4,12 +4,10 @@ on:
   push:
     tags: ["v*"]
 
-permissions:
-  id-token: write  # Required for OIDC
-  contents: write # Required for action-gh-release
-
 jobs:
   build-matrix:
+    permissions:
+      contents: read
     strategy:
       matrix:
         node-version:
@@ -58,6 +56,9 @@ jobs:
         path: build/stage/*.tar.gz
 
   create-release:
+    permissions:
+      id-token: write # Required for OIDC
+      contents: write # Required for action-gh-release
     runs-on: ubuntu-latest
     needs: build-matrix
     steps: