diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f946582..7b25963 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,8 +10,6 @@ on:
 permissions:
   actions: read
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
   main:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 81c4e3a..b3469b4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -8,6 +8,11 @@ on:
     workflows: ['CI']
     types: completed
 
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
 jobs:
   deploy:
     runs-on: ubuntu-latest