diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d1fe401..3504c5c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -4,6 +4,9 @@ on:
     types: [opened]
   pull_request:
     types: [opened]
+
+permissions: {}
+
 jobs:
   run:
     name: Notify IS team of github activity
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index c3f932d..f43a1e1 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -3,6 +3,9 @@ name: Repo Sync
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   repo-sync:
     name: Repo Sync