diff --git a/.github/workflows/pull_request.yaml b/.github/workflows/pull_request.yaml
index 1ff2619..c86e81c 100644
--- a/.github/workflows/pull_request.yaml
+++ b/.github/workflows/pull_request.yaml
@@ -4,6 +4,10 @@ on:
     branches: [ master ]
     types: [ opened, synchronize, reopened ]
 
+permissions:
+  contents: read
+  id-token: write
+
 env:
   MAVEN_INIT: 'false'
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 634a110..4187428 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,6 +4,10 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: read
+  id-token: write
+
 env:
   MAVEN_INIT: 'false'