diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5fd47af8b..18f85b94b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,8 +8,6 @@ permissions: read-all
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2f5c0a89f..dc118f1eb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,10 @@ name: Publish package to GitHub Packages
 on:
   release:
     types: [created]
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   publish:
     runs-on: ubuntu-latest