diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index f99f63f1da..420bd6f885 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -1,4 +1,6 @@
 name: Nightly Publication
+permissions:
+  contents: read
 on:
   schedule:
     - cron: "10 * * * *"
@@ -12,6 +14,8 @@ concurrency:
 jobs:
   tag-main:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 44fb3e9862..b5ebc328c8 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -1,5 +1,7 @@
 # Tags the latest main, to trigger a release.
 name: Tag main as tip
+permissions:
+  contents: write
 on:
   pull_request:
     branches: