diff --git a/.github/workflows/publish-ide-docs.yml b/.github/workflows/publish-ide-docs.yml
index 1e17d37..3ecf7ed 100644
--- a/.github/workflows/publish-ide-docs.yml
+++ b/.github/workflows/publish-ide-docs.yml
@@ -5,11 +5,13 @@ on:
     tags:
     - 'v4.*'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   publish_ide_docs:
     runs-on: ubuntu-22.04
-    permissions:
-      id-token: write
     steps:
     - name: Get version from tag
       run: |
diff --git a/.github/workflows/publish-jedi.yml b/.github/workflows/publish-jedi.yml
index 6d911b4..790f97e 100644
--- a/.github/workflows/publish-jedi.yml
+++ b/.github/workflows/publish-jedi.yml
@@ -5,11 +5,13 @@ on:
     tags:
     - 'v4.*'
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   publish_jedi:
     runs-on: ubuntu-22.04
-    permissions:
-      id-token: write
     steps:
     - uses: actions/checkout@v6
     - name: Get version from tag