diff --git a/.github/workflows/azure-functions-smoke-tests.yml b/.github/workflows/azure-functions-smoke-tests.yml
index 9ee868fda..dab61e597 100644
--- a/.github/workflows/azure-functions-smoke-tests.yml
+++ b/.github/workflows/azure-functions-smoke-tests.yml
@@ -10,6 +10,9 @@ on:
     paths-ignore: [ '**.md' ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   smoke-tests:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/validate-build.yml b/.github/workflows/validate-build.yml
index 0cc79a167..f1e645259 100644
--- a/.github/workflows/validate-build.yml
+++ b/.github/workflows/validate-build.yml
@@ -12,6 +12,9 @@ on:
       - 'feature/**'
     paths-ignore: [ '**.md' ]
 
+permissions:
+  contents: read
+
 env:
   solution: Microsoft.DurableTask.sln
   config: release