diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 5465cbf0..7d0d63f6 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -19,6 +19,9 @@ name: GitHub CI
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build it
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index adf40709..bc4653c3 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -4,6 +4,13 @@ on:
     branches:
       - master
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
    update_release_draft:
+      # the called workflow drafts the release and reads merged pull requests
+      permissions:
+         contents: write
+         pull-requests: read
       uses: codehaus-plexus/.github/.github/workflows/release-drafter.yml@master