diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index e1d760b52..3da0f9060 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -8,14 +8,14 @@ on:
       - master
       - 1.23.X
   workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: write # enable write permissions for pull request comments
+permissions: {}
 
 jobs:
   json-yaml-validate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # enable write permissions for pull request comments
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with: { persist-credentials: false }
@@ -30,6 +30,8 @@ jobs:
   # General validations
   validate:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with: { persist-credentials: false }