diff --git a/.github/workflows/build_and_test_cap.yml b/.github/workflows/build_and_test_cap.yml
index b2e638a..c6b80f2 100644
--- a/.github/workflows/build_and_test_cap.yml
+++ b/.github/workflows/build_and_test_cap.yml
@@ -3,6 +3,9 @@
 
 name: CAP sample
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ "main" ]
diff --git a/.github/workflows/build_and_test_expressjs.yml b/.github/workflows/build_and_test_expressjs.yml
index da1c814..1b9e3d3 100644
--- a/.github/workflows/build_and_test_expressjs.yml
+++ b/.github/workflows/build_and_test_expressjs.yml
@@ -3,6 +3,9 @@
 
 name: Express sample
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ "main" ]