diff --git a/.github/workflows/build-and-publish-docs.yml b/.github/workflows/build-and-publish-docs.yml
index dcb35d65..00f2a5fa 100644
--- a/.github/workflows/build-and-publish-docs.yml
+++ b/.github/workflows/build-and-publish-docs.yml
@@ -7,6 +7,11 @@ on:
       SSH_DEPLOY_KEY:
         required: true
 
+# Docs are pushed to the sdk-docs repo via SSH_DEPLOY_KEY, not GITHUB_TOKEN,
+# so this workflow only needs to read its own repo.
+permissions:
+  contents: read
+
 jobs:
   build-and-deploy-documentation:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9acfb84c..522bea5c 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -7,6 +7,10 @@ on:
     branches:
       - main
 
+# Least-privilege default: build, integration tests, and cleanup only read the repo.
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy: