diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml
index aa11092a..15f35ac7 100644
--- a/.github/workflows/build-and-release.yml
+++ b/.github/workflows/build-and-release.yml
@@ -52,6 +52,9 @@ on:
       - 'var/macos/**'
       - 'var/windows/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index e016ea39..70ff9429 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,6 +18,7 @@ on:
       - '.github/workflows/codeql-analysis.yml'
       - 'frontend/**'
       - 'integration-tests/**'
+      - 'lang/**'
       - 'proto/**'
       - 'service/**'
     branches: [main, next]
@@ -26,6 +27,7 @@ on:
       - '.github/workflows/codeql-analysis.yml'
       - 'frontend/**'
       - 'integration-tests/**'
+      - 'lang/**'
       - 'proto/**'
       - 'service/**'
     branches: [main, next]