diff --git a/.github/workflows/go-version.yaml b/.github/workflows/go-version.yaml
index 12831ed77..46107f4b5 100644
--- a/.github/workflows/go-version.yaml
+++ b/.github/workflows/go-version.yaml
@@ -1,4 +1,5 @@
 name: Go version setup
+permissions: read-all
 
 on:
   workflow_call:
diff --git a/.github/workflows/tests-arm64.yaml b/.github/workflows/tests-arm64.yaml
index 5f4883e5d..793e269d3 100644
--- a/.github/workflows/tests-arm64.yaml
+++ b/.github/workflows/tests-arm64.yaml
@@ -2,6 +2,7 @@ name: Tests-arm64
 on:
   schedule:
     - cron: '30 1 * * *' # runs daily at 1:30 am.
+permissions: read-all
 jobs:
   goversion:
     uses: ./.github/workflows/go-version.yaml