diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17b96c1..814b520 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,6 +41,9 @@ jobs:
     name: CodeQL
     uses: ./.github/workflows/codeql.yml
     secrets: inherit
+    permissions:
+      security-events: write
+      actions: read
 
   spellcheck:
     name: Spell Check
diff --git a/.github/workflows/rolling-release.yml b/.github/workflows/rolling-release.yml
index 9207e80..b9d2f47 100644
--- a/.github/workflows/rolling-release.yml
+++ b/.github/workflows/rolling-release.yml
@@ -40,6 +40,9 @@ jobs:
     name: CodeQL
     uses: ./.github/workflows/codeql.yml
     secrets: inherit
+    permissions:
+      security-events: write
+      actions: read
 
   spellcheck:
     name: Spell Check