diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 56f5f6c..6a0dd1c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,9 +12,12 @@ on:
     - cron: '23 3 * * 1'
 permissions:
   contents: read
-  checks: write
 jobs:
   build:
+    permissions:
+      contents: read
+      # the TCK test report is published as a check run
+      checks: write
     uses: osgi/.github/.github/workflows/spec-build.yml@main
     secrets: inherit
     with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9f64855..d1a2d7f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
   push:
     tags:
       - '[0-9]*.[0-9]*.[0-9]*'
+permissions:
+  contents: read
 jobs:
   release:
     uses: osgi/.github/.github/workflows/spec-release.yml@main