diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 0736dfc8e..73c53ce54 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -15,6 +15,9 @@ permissions: {}
 jobs:
   build-notebooks:
     uses: ./.github/workflows/build-notebooks.yml
+    permissions:
+      actions: read
+      contents: write
     with:
       use_cache: ${{ github.event_name == 'workflow_dispatch' && inputs.use_cache || false }}
     secrets: inherit
diff --git a/.github/workflows/pack-tutorials.yml b/.github/workflows/pack-tutorials.yml
index a505684c3..4b2c3d57c 100644
--- a/.github/workflows/pack-tutorials.yml
+++ b/.github/workflows/pack-tutorials.yml
@@ -10,6 +10,9 @@ permissions: {}
 jobs:
   build-notebooks:
     uses: ./.github/workflows/build-notebooks.yml
+    permissions:
+      actions: read
+      contents: write
     secrets: inherit
   zip-and-upload:
     needs: build-notebooks