diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54aaa11..1bc1904 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,7 +93,11 @@ jobs:
     # gha-generate-matrix script.php will sanitise matrix outputs so they're safe to use within bash
     outputs:
       matrix: ${{ steps.generate-matrix.outputs.matrix }}
-    
+
+    permissions:
+      contents: read
+      pull-requests: read
+
     steps:
       - name: Generate matrix
         id: generate-matrix
@@ -169,6 +173,9 @@ jobs:
     outputs:
       latest_local_sha: ${{ steps.output-sha.outputs.latest_local_sha }}
 
+    permissions:
+      contents: read
+
     steps:
 
       - name: Checkout code