diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a78d0db4ffc..de815583ee1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     branches:
       - static_h
+
+permissions:
+  contents: read
+
 jobs:
   macos:
     runs-on: macos-15
diff --git a/.github/workflows/rn-build-hermes.yml b/.github/workflows/rn-build-hermes.yml
index 0a3a82ae91a..a1b60d9797e 100644
--- a/.github/workflows/rn-build-hermes.yml
+++ b/.github/workflows/rn-build-hermes.yml
@@ -19,6 +19,9 @@ on:
       - 250829098.0.0-stable
       - static_h
 
+permissions:
+  contents: read
+
 jobs:
   set_release_type:
     runs-on: ubuntu-latest