diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 4d6a5e7dfb..93a7a364ef 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -5,6 +5,10 @@ on:
   pull_request:
   release:
     types: [created]
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Test the code with Keras 2
diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml
index a1774c9057..0e0d101320 100644
--- a/.github/workflows/publish-to-pypi.yml
+++ b/.github/workflows/publish-to-pypi.yml
@@ -1,6 +1,10 @@
 name: Publish to PyPI
 
 on: push
+
+permissions:
+  contents: read
+
 jobs:
   build-and-publish:
     name: Build and publish to PyPI