diff --git a/.github/workflows/codacy-analysis.yml b/.github/workflows/codacy-analysis.yml
index 43875b6..1ee6c7a 100644
--- a/.github/workflows/codacy-analysis.yml
+++ b/.github/workflows/codacy-analysis.yml
@@ -22,8 +22,15 @@ on:
   schedule:
     - cron: '27 22 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   codacy-security-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     name: Codacy Security Scan
     runs-on: ubuntu-24.04
     steps:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d23bc1a..d89162c 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,10 +25,16 @@ jobs:
     name: Analyze
     runs-on: ubuntu-24.04
     permissions:
-      actions: read
-      contents: read
+      # required for all workflows
       security-events: write
 
+      # required to fetch internal or private CodeQL packs
+      #packages: read
+
+      # only required for workflows in private repositories
+      #actions: read
+      #contents: read
+
     strategy:
       fail-fast: false
       matrix: