diff --git a/.github/workflows/lockthreads.yml b/.github/workflows/lockthreads.yml
index e2988122f..65ff08d0f 100644
--- a/.github/workflows/lockthreads.yml
+++ b/.github/workflows/lockthreads.yml
@@ -7,8 +7,14 @@ on:
 #   min 0-59 ┘ │  │ │ └ weekday 0-6
 #    hour 0-23 ┘  │ └ month 1-12
 #                 └ day 1-31
+permissions:
+  contents: read
+
 jobs:
   lock:
+    permissions:
+      issues: write  # for dessant/lock-threads to lock issues
+      pull-requests: write  # for dessant/lock-threads to lock PRs
     runs-on: ubuntu-latest
     steps:
       - uses: dessant/lock-threads@v2
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b3c15688b..38ffbf481 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,6 +6,9 @@ env:
   CTEST_PARALLEL_LEVEL: "1"
   CMAKE_BUILD_PARALLEL_LEVEL: "4"
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu: