diff --git a/.github/workflows/on_doc_merge.yml b/.github/workflows/on_doc_merge.yml
index b0115b755c..c977e64624 100644
--- a/.github/workflows/on_doc_merge.yml
+++ b/.github/workflows/on_doc_merge.yml
@@ -15,6 +15,7 @@ jobs:
   release-docs:
     permissions:
       id-token: write  # trade JWT token for AWS credentials in AWS Docs account
+      contents: read  # read from this repo to publish docs
     secrets: inherit
     uses: ./.github/workflows/reusable_publish_docs.yml
     with:
diff --git a/.github/workflows/rebuild_latest_docs.yml b/.github/workflows/rebuild_latest_docs.yml
index b943dea3bc..717e6b0af2 100644
--- a/.github/workflows/rebuild_latest_docs.yml
+++ b/.github/workflows/rebuild_latest_docs.yml
@@ -29,6 +29,7 @@ jobs:
   release-docs:
     permissions:
       id-token: write  # trade JWT token for AWS credentials in AWS Docs account
+      contents: read  # read from this repo to publish docs
     secrets: inherit
     uses: ./.github/workflows/reusable_publish_docs.yml
     with: