diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
index 052e6b7f94..fd539bb871 100644
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -36,7 +36,6 @@ permissions:
   id-token: write  # Required to log in to Azure.
   contents: read
   checks: read  # Required by reusable-test.yml to check build status.
-  security-events: write  # Required by codeql task.
   issues: write  # Required to create issues.
 
 jobs:
@@ -337,6 +336,10 @@ jobs:
     # Always run this job.
     needs: regular
     if: github.event_name == 'schedule' || github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch'
+    permissions:
+      checks: read  # Required by ossar-scan.yml to wait for build checks.
+      contents: read  # Required by ossar-scan.yml to fetch code.
+      security-events: write  # Required by ossar-scan to upload SARIF results.
     uses: ./.github/workflows/ossar-scan.yml
     with:
       build_artifact: Build-x64
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index af199e78f9..a6faa22fde 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,7 +24,6 @@ permissions:
   id-token: write  # Required to log in to Azure.
   contents: read
   checks: read  # Required by reusable-test.yml to check build status.
-  security-events: write  # Required by codeql task.
   issues: write  # Required to create issues.
 
 jobs:
@@ -33,6 +32,12 @@ jobs:
   codeql:
     # Only run during daily scheduled run
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    permissions:
+      id-token: write  # Required to log in to Azure.
+      contents: read
+      checks: read  # Required by reusable-build.yml to check build status.
+      security-events: write  # Required by codeql task.
+      issues: write  # Required to create issues.
     uses: ./.github/workflows/reusable-build.yml
     with:
       ref: ${{ github.ref }}