diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml
index 4ab8bade..333d98e6 100644
--- a/.github/workflows/docker-images.yml
+++ b/.github/workflows/docker-images.yml
@@ -43,6 +43,10 @@ jobs:
             tag: check
             tag-as-latest: true
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check out repository
         uses: actions/checkout@v7
diff --git a/.github/workflows/nox.yml b/.github/workflows/nox.yml
index f115d7c2..5c85a904 100644
--- a/.github/workflows/nox.yml
+++ b/.github/workflows/nox.yml
@@ -15,6 +15,9 @@ name: nox
     - cron: '0 9 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # Make sure there is at most one active run per PR, but do not cancel any non-PR runs
   group: ${{ github.workflow }}-${{ (github.head_ref && github.event.number) || github.run_id }}