diff --git a/.github/workflows/cherry-picker.yml b/.github/workflows/cherry-picker.yml
index d158a76..d291124 100644
--- a/.github/workflows/cherry-picker.yml
+++ b/.github/workflows/cherry-picker.yml
@@ -6,6 +6,9 @@
   issues:
     types: [closed, milestoned]
 
+permissions:
+  contents: read
+
 env:
   GH_TOKEN: ${{ secrets.BAZEL_IO_TOKEN }}
 
diff --git a/.github/workflows/remove-labels.yml b/.github/workflows/remove-labels.yml
index 3cf5578..e3df8d8 100644
--- a/.github/workflows/remove-labels.yml
+++ b/.github/workflows/remove-labels.yml
@@ -4,10 +4,12 @@
   pull_request_target:
     types: ["closed"]
 
+permissions:
+  contents: read
+
 jobs:
   remove-label:
     permissions:
-      contents: read
       pull-requests: write
     runs-on: ubuntu-latest
     steps: