diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c685fdb5fa..ec4506072f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,6 +11,9 @@ env:
   DOCKER_SWARMKIT_USE_CONTAINER: 1
   IMAGE_NAME: moby/swarmkit
 
+permissions:
+  contents: read
+
 jobs:
   build-dev:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 080dfa65a9..34a5809a04 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -15,6 +15,9 @@ on:
 env:
   DOCKER_SWARMKIT_USE_CONTAINER: 1
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-22.04