diff --git a/.github/workflows/ci-java.yml b/.github/workflows/ci-java.yml
index b2ad27f9d2..a34fa6339b 100644
--- a/.github/workflows/ci-java.yml
+++ b/.github/workflows/ci-java.yml
@@ -15,6 +15,7 @@ on:
       - main
 
 permissions:
+  contents: read
   pull-requests: write
 
 jobs:
diff --git a/.github/workflows/close-stale.yaml b/.github/workflows/close-stale.yaml
index 55faf33f71..3a609b9061 100644
--- a/.github/workflows/close-stale.yaml
+++ b/.github/workflows/close-stale.yaml
@@ -4,6 +4,7 @@ on:
     - cron: "40 3 * * *" # Run daily at 3:40 AM
 
 permissions:
+  contents: read
   issues: write
   pull-requests: write