diff --git a/.github/workflows/ci-darwin-arm64v8.yml b/.github/workflows/ci-darwin-arm64v8.yml
index 7c88ddbf2..57ea98428 100644
--- a/.github/workflows/ci-darwin-arm64v8.yml
+++ b/.github/workflows/ci-darwin-arm64v8.yml
@@ -2,8 +2,11 @@ name: CI (MacStadium)
 on:
   - push
   - pull_request
+permissions: {}
 jobs:
   CI:
+    permissions:
+      contents: write # for npx prebuild to make release
     runs-on: macos-m1
     strategy:
       fail-fast: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c8ed12e51..cb5190369 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,8 +2,13 @@ name: CI (GitHub)
 on:
   - push
   - pull_request
+permissions: {}
 jobs:
   CI:
+    permissions:
+      contents: write # for npx prebuild to make release
+      checks: write # to create new checks (coverallsapp/github-action)
+
     runs-on: ${{ matrix.os }}
     container: ${{ matrix.container }}
     strategy: