diff --git a/.github/workflows/cicd-push.yml b/.github/workflows/cicd-push.yml
index 60596d8d4..672781c27 100644
--- a/.github/workflows/cicd-push.yml
+++ b/.github/workflows/cicd-push.yml
@@ -11,9 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-unit:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     services:
       postgres:
         image: pgvector/pgvector:pg16
diff --git a/.github/workflows/compat-test.yml b/.github/workflows/compat-test.yml
index 7add7f034..88a510cc0 100644
--- a/.github/workflows/compat-test.yml
+++ b/.github/workflows/compat-test.yml
@@ -23,12 +23,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # ───────────────────────────────────────────────────────
   # Job 1: Graph store compatibility (PG always, Neo4j/Nebula opt-in)
   # ───────────────────────────────────────────────────────
   graph-compat:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -172,6 +176,7 @@ jobs:
   # ───────────────────────────────────────────────────────
   vector-compat:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix: