diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 0a89b94..03bca75 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -2,6 +2,9 @@
 on: [push, pull_request]          # yamllint disable-line rule:truthy
 name: Integration tests
 
+permissions: 
+  contents: read
+
 jobs:
   integration-tests:
     uses: coreruleset/crs-plugin-test-action/.github/workflows/integration.yaml@738f25b8d5ee671dcc8ba76aa29365ffd690309a # v3.0.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b6e8df2..9d54f38 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,6 +1,9 @@
----
 on: [push, pull_request]        # yamllint disable-line rule:truthy
+name: Plugin lint
+
+permissions:
+  contents: read      # restrict repo access
 
 jobs:
   plugin-lint:
-    uses: coreruleset/crs-plugin-test-action/.github/workflows/lint.yaml@7e1ee6d07105ae3cb6eec95e45acb5e1a895e3d4 # main
+    uses: coreruleset/crs-plugin-test-action/.github/workflows/lint.yaml@7e1ee6d07105ae3cb6eec95e45acb5e1a895e3d4 # pinned SHA for v3.0.0