diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml
index 71997984b..6ce70b5fb 100644
--- a/.github/workflows/__analyze-ref-input.yml
+++ b/.github/workflows/__analyze-ref-input.yml
@@ -35,6 +35,8 @@ jobs:
         - macos-latest
         - windows-latest
     name: "Analyze: 'ref' and 'sha' from inputs"
+    permissions:
+      security-events: write
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository
diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml
index 72cf3b24d..e158f6ba7 100644
--- a/.github/workflows/__upload-ref-sha-input.yml
+++ b/.github/workflows/__upload-ref-sha-input.yml
@@ -35,6 +35,8 @@ jobs:
         - macos-latest
         - windows-latest
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
+    permissions:
+      security-events: write
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository