diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0efaddd2e..2f0805968 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,6 +87,9 @@ jobs:
     if: ${{ failure() && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-')) }}
     runs-on: [self-hosted, linux, x64, igneum-build-1]
     timeout-minutes: 5
+    permissions:
+      actions: read     # the run's jobs API (the first real red run, 21:19Z: the default token answered 403 and the line carried no step)
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index cfe19eeed..82aa2f60c 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -302,6 +302,9 @@ jobs:
     if: ${{ failure() && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-')) }}
     runs-on: [self-hosted, linux, x64, igneum-build-1]
     timeout-minutes: 5
+    permissions:
+      actions: read     # the run's jobs API (the first real red run, 21:19Z: the default token answered 403 and the line carried no step)
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with: