diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 5c811e96f..9976e8e17 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -1,6 +1,8 @@
 ---
 name: Images
 
+permissions: {}
+
 on:
   pull_request:
   workflow_run:
diff --git a/.github/workflows/update-sh.yml b/.github/workflows/update-sh.yml
index ce2383bd7..b3d1f3d46 100644
--- a/.github/workflows/update-sh.yml
+++ b/.github/workflows/update-sh.yml
@@ -1,6 +1,9 @@
 ---
 name: update.sh
 
+permissions:
+  contents: write
+
 on:
   push:
     branches: