diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index 18028344c..8767fe43f 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -21,12 +21,6 @@ on:
     branches:
       - main
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 # Allow only one concurrent deployment
 concurrency:
   group: "pages"
@@ -34,6 +28,8 @@ concurrency:
 
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -77,6 +73,9 @@ jobs:
           path: docs/dist
 
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c08e3f054..ea2c6fd03 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,13 +33,11 @@ on:
           - minor
           - major
 
-permissions:
-  contents: write
-  packages: write
-  pull-requests: write
-
 jobs:
   release:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
@@ -61,6 +59,9 @@ jobs:
           manifest-file: .release-please-manifest.json
 
   publish:
+    permissions:
+      contents: read
+      packages: write
     needs: release
     if: ${{ needs.release.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
@@ -100,6 +101,9 @@ jobs:
 
   # Snapshot publishing on main branch (without release)
   publish-snapshot:
+    permissions:
+      contents: read
+      packages: write
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     steps: