diff --git a/.github/workflows/reusable-cpp-coverage.yml b/.github/workflows/reusable-cpp-coverage.yml
index ede9f9b..5a3b5e5 100644
--- a/.github/workflows/reusable-cpp-coverage.yml
+++ b/.github/workflows/reusable-cpp-coverage.yml
@@ -20,7 +20,8 @@ jobs:
     name: 📈 Coverage
     runs-on: ubuntu-latest
     permissions:
-      id-token: write
+      contents: read # Required for the `actions/checkout` action
+      id-token: write # Required for the `codecov/codecov-action` action
     env:
       CMAKE_BUILD_PARALLEL_LEVEL: 4
       CTEST_PARALLEL_LEVEL: 4
diff --git a/.github/workflows/reusable-python-ci.yml b/.github/workflows/reusable-python-ci.yml
index 4708705..2bfba1b 100644
--- a/.github/workflows/reusable-python-ci.yml
+++ b/.github/workflows/reusable-python-ci.yml
@@ -57,7 +57,8 @@ jobs:
     needs: [python-tests]
     runs-on: ubuntu-latest
     permissions:
-      id-token: write
+      contents: read # Required for the `actions/checkout` action
+      id-token: write # Required for the `codecov/codecov-action` action
     steps:
       # check out the repository (mostly for the codecov config)
       - uses: actions/checkout@v4