diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5402c66..5cbe09a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,6 +5,8 @@ on:
     branches:
     - main
   pull_request:
+permissions:
+  contents: read
 jobs:
   # FIXME(lufia): revert this
   #
diff --git a/.github/workflows/vuln.yml b/.github/workflows/vuln.yml
index 26969ef..604bf93 100644
--- a/.github/workflows/vuln.yml
+++ b/.github/workflows/vuln.yml
@@ -3,7 +3,8 @@ name: Vulncheck
 on:
   schedule:
   - cron: '0 10 */14 * *'
+permissions:
+  contents: read
 jobs:
   vuln:
-    permissions:
     uses: lufia/workflows/.github/workflows/go-vulncheck.yml@bfc84184198b340bf1c34b2c695c2810a8e0897e # v0.11.1