diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f9917c1..2811ae2 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -29,6 +29,8 @@ jobs:
     needs: diff
     if: needs.diff.outputs.hash-master != needs.diff.outputs.hash-main
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - uses: actions/checkout@v3
       with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 503ac32..295c53e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
     strategy:
       fail-fast: true
     steps: