diff --git a/.github/workflows/branch-main.yml b/.github/workflows/branch-main.yml
index bd2181c95..30616da94 100644
--- a/.github/workflows/branch-main.yml
+++ b/.github/workflows/branch-main.yml
@@ -48,6 +48,11 @@ jobs:
     name: Build gasp-node
     uses: ./.github/workflows/reusable-gasp-node-build-and-test.yml
     secrets: inherit
+    permissions:
+      contents: read
+      actions: read
+      checks: write
+      id-token: write
     with:
       version: ${{ needs.init.outputs.GLOBAL_VERSION }}
       branch: ${{ needs.init.outputs.GIT_BRANCH }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 673ecbc32..7fcd60edb 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -49,6 +49,11 @@ jobs:
     name: Build gasp-node
     uses: ./.github/workflows/reusable-gasp-node-build-and-test.yml
     secrets: inherit
+    permissions:
+      contents: read
+      actions: read
+      checks: write
+      id-token: write
     with:
       version: ${{ needs.init.outputs.GLOBAL_VERSION }}
       branch: ${{ needs.init.outputs.GIT_BRANCH }}