diff --git a/.github/workflows/cs.yml b/.github/workflows/cs.yml
index acebd1d..bdea204 100644
--- a/.github/workflows/cs.yml
+++ b/.github/workflows/cs.yml
@@ -12,8 +12,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   checkcs:
+    permissions:
+      contents: read # To clone the repo.
+
     name: 'Check code style'
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index cca170c..9713fed 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,9 +12,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   test:
-    runs-on: ubuntu-latest
+    permissions:
+      contents: read # To clone the repo.
 
     strategy:
       matrix:
@@ -40,9 +44,11 @@ jobs:
           - php: '8.6'
             experimental: true
 
-    name: "Test on PHP ${{ matrix.php }}"
     continue-on-error: ${{ matrix.experimental }}
 
+    name: "Test on PHP ${{ matrix.php }}"
+    runs-on: ubuntu-latest
+
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -97,8 +103,10 @@ jobs:
         run: composer phpunit10
 
   coverage:
+    permissions:
+      contents: read # To clone the repo.
+
     needs: test
-    runs-on: ubuntu-latest
 
     strategy:
       matrix:
@@ -106,6 +114,7 @@ jobs:
           - '7.4'
 
     name: "Coverage on PHP ${{ matrix.php }}"
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code