diff --git a/.github/workflows/buildpack-integration-test.yml b/.github/workflows/buildpack-integration-test.yml
index ba4aecb7..78c56996 100644
--- a/.github/workflows/buildpack-integration-test.yml
+++ b/.github/workflows/buildpack-integration-test.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - master
   workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   python37:
     uses: GoogleCloudPlatform/functions-framework-conformance/.github/workflows/buildpack-integration-test.yml@v1.8.0
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index f5535637..ec75d5b4 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -1,8 +1,12 @@
 name: Python Conformance CI
 on: [push, pull_request]
+
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   build:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         python: ['3.7', '3.8', '3.9', '3.10', '3.11']