diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bb6a9ce542983..a215eae20e483 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -557,6 +557,9 @@ jobs:
   test-api:
     name: 🔨 Test API (CE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -574,6 +577,9 @@ jobs:
   test-api-livechat:
     name: 🔨 Test API Livechat (CE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -591,6 +597,9 @@ jobs:
   test-ui:
     name: 🔨 Test UI (CE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -617,6 +626,9 @@ jobs:
   test-api-ee:
     name: 🔨 Test API (EE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -638,6 +650,9 @@ jobs:
   test-api-livechat-ee:
     name: 🔨 Test API Livechat (EE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with:
@@ -659,6 +674,9 @@ jobs:
   test-ui-ee:
     name: 🔨 Test UI (EE)
     needs: [checks, build-gh-docker-publish, release-versions]
+    permissions:
+      actions: read
+      contents: read
 
     uses: ./.github/workflows/ci-test-e2e.yml
     with: