diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b27e503d..695d2b38 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,6 +1,14 @@
 name: Tests
 
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - master
+      - '*.x'
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   tests:
diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml
index 1625bda1..ebda6206 100644
--- a/.github/workflows/update-changelog.yml
+++ b/.github/workflows/update-changelog.yml
@@ -4,6 +4,10 @@ on:
   release:
     types: [released]
 
+permissions: {}
+
 jobs:
   update:
+    permissions:
+      contents: write
     uses: laravel/.github/.github/workflows/update-changelog.yml@main