diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 265b05f2..911bef87 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Set all permissions to none
+permissions: {}
+
 jobs:
   # `allTests` used to run in a single job alongside `assemble`. On a 7 GB
   # ubuntu-latest runner the combined peak RSS (Gradle JVM + Kotlin daemon +
@@ -36,6 +39,10 @@ jobs:
             tasks: jsTest wasmJsTest wasmWasiTest
           - name: native
             tasks: linuxX64Test
+
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -101,6 +108,10 @@ jobs:
     name: assemble
     runs-on: ubuntu-latest
     timeout-minutes: 40
+
+    permissions:
+      contents: read
+      
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1