diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 529066a..250e200 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,6 +23,9 @@ on:
         required: true
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: Run tests
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index bfcb855..bce8bef 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -11,6 +11,7 @@ on:
   pull_request:
     branches:
       - 'main'
+      - 'release/*'
   push:
     branches:
       - 'main'
@@ -20,6 +21,9 @@ on:
   workflow_dispatch: {}
   workflow_call: {}
 
+permissions:
+  contents: read
+
 jobs:
   version:
     runs-on: ubuntu-latest