diff --git a/.github/workflows/build-fgds.yml b/.github/workflows/build-fgds.yml
index 8abc7b765..85126e99e 100644
--- a/.github/workflows/build-fgds.yml
+++ b/.github/workflows/build-fgds.yml
@@ -10,6 +10,11 @@ on:
       - 'fgd/**'
   workflow_dispatch:
     # Allow triggering manually whenever it's useful.
+
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build-fgds:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/build-postcompiler.yml b/.github/workflows/build-postcompiler.yml
index 4eadb53b1..51488a215 100644
--- a/.github/workflows/build-postcompiler.yml
+++ b/.github/workflows/build-postcompiler.yml
@@ -7,6 +7,10 @@ on:
   workflow_dispatch:
     # Allow triggering manually whenever it's useful.
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   freeze:
     strategy: