diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 3ebf655..6881743 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -1,19 +1,22 @@
 name: Node CI
 
+permissions:
+  contents: read
+
 on: [push, pull_request]
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
-      with:
-        node-version: 22
-        cache: npm
-    - name: npm install, build, and test
-      run: |
-        npm install
-        npm run build
-        npm test
-      env:
-        CI: true
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: npm install, build, and test
+        run: |
+          npm install
+          npm run build
+          npm test
+        env:
+          CI: true
diff --git a/.github/workflows/publish-pages.yml b/.github/workflows/publish-pages.yml
index abd2d6a..7b5a9c9 100644
--- a/.github/workflows/publish-pages.yml
+++ b/.github/workflows/publish-pages.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest