diff --git a/.github/workflows/ci-test-docker-compose.yaml b/.github/workflows/ci-test-docker-compose.yaml
index b56f7c0d7eb..60226f14268 100644
--- a/.github/workflows/ci-test-docker-compose.yaml
+++ b/.github/workflows/ci-test-docker-compose.yaml
@@ -1,4 +1,8 @@
 name: 'Test Docker Compose'
+
+permissions:
+  contents: read
+
 on:
   pull_request:
 
diff --git a/.github/workflows/docs-i18n-pull.yaml b/.github/workflows/docs-i18n-pull.yaml
index cc2e9ac56a7..519bafb0c7a 100644
--- a/.github/workflows/docs-i18n-pull.yaml
+++ b/.github/workflows/docs-i18n-pull.yaml
@@ -124,7 +124,9 @@ jobs:
             exit 0
           fi
           git commit -m "chore: sync docs artifacts"
-          git push origin HEAD:${{ github.head_ref }}
+          git push origin "HEAD:$HEAD_REF"
+        env:
+          HEAD_REF: ${{ github.head_ref }}
 
       - name: Check for changes and commit
         if: github.event_name != 'pull_request'