diff --git a/.github/workflows/ci-no-dns.yaml b/.github/workflows/ci-no-dns.yaml
index 51211bdd..48a35fff 100644
--- a/.github/workflows/ci-no-dns.yaml
+++ b/.github/workflows/ci-no-dns.yaml
@@ -20,6 +20,8 @@ concurrency:
 jobs:
   no-dns:
     name: LXC deploy and test
+    permissions:
+      contents: read
     uses: chatmail/cmlxc/.github/workflows/lxc-test.yml@main
     with:
       cmlxc_version: main
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index d34f79b1..1fe6a8c7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -57,6 +57,8 @@ jobs:
 
   lxc-test:
     name: LXC deploy and test
+    permissions:
+      contents: read
     uses: chatmail/cmlxc/.github/workflows/lxc-test.yml@main
     with:
       cmlxc_version: main