diff --git a/.github/workflows/cpp-packaging.yml b/.github/workflows/cpp-packaging.yml
index e7d1b78a01..2719961866 100644
--- a/.github/workflows/cpp-packaging.yml
+++ b/.github/workflows/cpp-packaging.yml
@@ -39,6 +39,9 @@ env:
   llvmVer: "5f187f0afaad33013ba03454c4749d99b1362534"
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 jobs:
   log_inputs:
     name: log-inputs
@@ -866,8 +869,8 @@ jobs:
     steps:
     - name: Checkout repo
       uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-        with:
-          persist-credentials: true # zizmor: ignore[artipacked]
+      with:
+        persist-credentials: true # zizmor: ignore[artipacked]
 
     - name: Setup python
       uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -942,8 +945,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-          with:
-            persist-credentials: true # zizmor: ignore[artipacked]
+        with:
+          persist-credentials: true # zizmor: ignore[artipacked]
       - name: Setup python
         uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
         with:
diff --git a/.github/workflows/update-feature-branches.yml b/.github/workflows/update-feature-branches.yml
index 52503aca54..300caafef8 100644
--- a/.github/workflows/update-feature-branches.yml
+++ b/.github/workflows/update-feature-branches.yml
@@ -33,8 +33,8 @@ jobs:
       - name: Check out repo (if needed)
         if: ${{ github.event.inputs.branch_list == '' }}
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
-          with:
-            persist-credentials: true # zizmor: ignore[artipacked]
+        with:
+          persist-credentials: true # zizmor: ignore[artipacked]
 
       - name: Get list of feature branches
         id: get-branches