diff --git a/.github/workflows/publish-insider-spearhead.yml b/.github/workflows/publish-insider-spearhead.yml
index bc7846e..fb6c91c 100644
--- a/.github/workflows/publish-insider-spearhead.yml
+++ b/.github/workflows/publish-insider-spearhead.yml
@@ -31,6 +31,7 @@ env:
 jobs:
   check:
     runs-on: macos-15
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}
diff --git a/.github/workflows/publish-stable-spearhead.yml b/.github/workflows/publish-stable-spearhead.yml
index 03976b3..792f7db 100644
--- a/.github/workflows/publish-stable-spearhead.yml
+++ b/.github/workflows/publish-stable-spearhead.yml
@@ -31,6 +31,7 @@ env:
 jobs:
   check:
     runs-on: macos-15
+    permissions: {}
     outputs:
       MS_COMMIT: ${{ env.MS_COMMIT }}
       MS_TAG: ${{ env.MS_TAG }}