diff --git a/.github/workflows/branch-name-check.yml b/.github/workflows/branch-name-check.yml
index 5db3666..e61ec4f 100644
--- a/.github/workflows/branch-name-check.yml
+++ b/.github/workflows/branch-name-check.yml
@@ -2,6 +2,10 @@ name: Enforce Branch Name Semantics
 on:
   pull_request:
     branches: ["main"]
+
+permissions:
+  contents: read
+  
 jobs:
   lint-branch-name:
     name: Lint Branch Name
diff --git a/.github/workflows/pr-validate.yml b/.github/workflows/pr-validate.yml
index 2cb549c..f677b3e 100644
--- a/.github/workflows/pr-validate.yml
+++ b/.github/workflows/pr-validate.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   unit-test-backend:
     name: Backend Unit Tests