diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4ae980d..e0a2d42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,11 @@ jobs:
     name: CI
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: coveo/stew@main
         name: Stew
         with:
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 38710ac..40e4b83 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -8,6 +8,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   push_to_registries:
     name: Push Docker image to Dockerhub
@@ -17,6 +20,11 @@ jobs:
       contents: read
     
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@v2
+      with:
+        egress-policy: audit
+
     - name: Check out the repo
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4