diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index ee1dd70..1273d85 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -11,6 +11,11 @@ on:
       - build/*
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
 env:
   GHCR_REPO: ghcr.io/trent-maetzold/protonmail-bridge
 
diff --git a/.github/workflows/scheduled-update.yaml b/.github/workflows/scheduled-update.yaml
index de493ff..34b19d4 100644
--- a/.github/workflows/scheduled-update.yaml
+++ b/.github/workflows/scheduled-update.yaml
@@ -4,6 +4,11 @@ on:
   schedule:
     - cron: '0 6 * * *'
 
+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
 env:
   GHCR_REPO: ghcr.io/trent-maetzold/protonmail-bridge