diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index f528509..0236ea3 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -3,11 +3,16 @@
 
 name: Enforce clang-format
 
+# Drop permissions to minimum, for security
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
+  workflow_dispatch:
 
 jobs:
   clang-format:
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 93a1076..d054e7e 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -12,6 +12,7 @@ on:
   push:
   schedule:
     - cron: '0 3 * * 5'  # Every Friday at 3am
+  workflow_dispatch:
 
 jobs:
   linux: