diff --git a/.github/workflows/hubs-RetPageOrigin.yml b/.github/workflows/hubs-RetPageOrigin.yml
index 43ca4bb96d..44ea8c9091 100644
--- a/.github/workflows/hubs-RetPageOrigin.yml
+++ b/.github/workflows/hubs-RetPageOrigin.yml
@@ -1,7 +1,6 @@
 name: hubs
 on:
   push:
-    branches:
     paths-ignore: ["README.md"]
   workflow_dispatch:
     # Smoke instances aren't currently set up as of 2024-09-08
@@ -17,6 +16,8 @@ on:
     #       - "smoke04"
     #       - "smoke05"
 
+permissions: {}
+
 jobs:
   turkeyGitops:
     uses: Hubs-Foundation/hubs-ops/.github/workflows/turkeyGitops.yml@master
diff --git a/.github/workflows/test-and-deploy-storybook.yml b/.github/workflows/test-and-deploy-storybook.yml
index 1a0dc8723f..adf8d0a6ac 100644
--- a/.github/workflows/test-and-deploy-storybook.yml
+++ b/.github/workflows/test-and-deploy-storybook.yml
@@ -2,7 +2,6 @@ name: test-and-deploy-storybook
 
 on:
   push:
-    branches:
   workflow_dispatch:
 
 permissions: {}
@@ -10,6 +9,7 @@ permissions: {}
 jobs:
   test-and-deploy-storybook:
     runs-on: ubuntu-latest
+    permissions: {contents: write}
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2