diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 61cc247..044dc87 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,6 +1,7 @@
 # Validate that the compiled artifacts are up-to-date.
 
 name: Build
+permissions: read-all
 
 on:
   pull_request:
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index fba99f9..739e4c8 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -1,6 +1,7 @@
 # Tests for general `setup-dart` configurations.
 
 name: Dart
+permissions: read-all
 
 on:
   push: