diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a413549..a95e178 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,6 +10,8 @@ on:
         required: false
 jobs:
   build-go:
+    permissions:
+      contents: read
     strategy:
       matrix:
         include:
@@ -87,6 +89,8 @@ jobs:
           name: Throne-${{ github.sha }}-Common-${{ matrix.cross_os }}-${{ matrix.cross_arch }}
           path: artifacts.tgz
   build-cpp:
+    permissions:
+      contents: read
     needs:
       - build-go
     strategy:
@@ -222,6 +226,9 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - build-cpp
+    permissions:
+      contents: write
+      actions: read
     env:
       INPUT_VERSION: ${{ github.event.inputs.tag }}
     steps: