diff --git a/.github/workflows/backend-ci.yml b/.github/workflows/backend-ci.yml
index 1fd0451..e76502f 100644
--- a/.github/workflows/backend-ci.yml
+++ b/.github/workflows/backend-ci.yml
@@ -16,6 +16,11 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/frontend-ci.yml b/.github/workflows/frontend-ci.yml
index 6976b59..e3d0639 100644
--- a/.github/workflows/frontend-ci.yml
+++ b/.github/workflows/frontend-ci.yml
@@ -13,6 +13,11 @@ on:
       - '.github/workflows/frontend-ci.yml'
   workflow_dispatch:
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest