diff --git a/.github/workflows/sphinx.yml b/.github/workflows/sphinx.yml
index 791556a..ca1feac 100644
--- a/.github/workflows/sphinx.yml
+++ b/.github/workflows/sphinx.yml
@@ -1,15 +1,13 @@
 name: Deploy sphinx site to Pages
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
@@ -36,6 +34,9 @@ jobs:
           path: ./docs/build/html
 
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index f7470b2..5a5567c 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -1,5 +1,8 @@
 name: Run tests upon pull request events
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches: ["main"]