diff --git a/.github/workflows/build-ripunzip.yml b/.github/workflows/build-ripunzip.yml
index 3e32b868985..c83b25de2c9 100644
--- a/.github/workflows/build-ripunzip.yml
+++ b/.github/workflows/build-ripunzip.yml
@@ -12,6 +12,9 @@ on:
         required: false
         default: openssl-3.5.0
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/csv-coverage-pr-comment.yml b/.github/workflows/csv-coverage-pr-comment.yml
index cf01ef063ac..2f48fc116a7 100644
--- a/.github/workflows/csv-coverage-pr-comment.yml
+++ b/.github/workflows/csv-coverage-pr-comment.yml
@@ -14,10 +14,7 @@ jobs:
   check:
     name: Check framework coverage differences and comment
     runs-on: ubuntu-latest
-    if: >
-      ${{ github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' }}
-
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
     steps:
     - name: Dump GitHub context
       env: