diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index bff849e3510a..7d3b2f2ae7b0 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -4,6 +4,9 @@ on:
     branches:
       - v2
 
+permissions:
+  contents: read
+
 # Ensure scripts are run with pipefail. See:
 # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
 defaults:
diff --git a/.github/workflows/close-preview.yml b/.github/workflows/close-preview.yml
index 45f80901c3ca..4d1ed526512b 100644
--- a/.github/workflows/close-preview.yml
+++ b/.github/workflows/close-preview.yml
@@ -9,6 +9,8 @@ on:
   pull_request_target:
     types: [closed]
 
+permissions: {}
+
 jobs:
   close:
     runs-on: ubuntu-latest