diff --git a/.github/workflows/conflicts.yaml b/.github/workflows/conflicts.yaml
index c5dc3dfd..c25eb76d 100644
--- a/.github/workflows/conflicts.yaml
+++ b/.github/workflows/conflicts.yaml
@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [synchronize]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/label.yaml b/.github/workflows/label.yaml
index 679d4f5d..c476d848 100644
--- a/.github/workflows/label.yaml
+++ b/.github/workflows/label.yaml
@@ -3,6 +3,9 @@ name: Label
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   label:
     name: PR