diff --git a/.github/workflows/licenses.yml b/.github/workflows/licenses.yml
index 970ed87a2a..755852add2 100644
--- a/.github/workflows/licenses.yml
+++ b/.github/workflows/licenses.yml
@@ -10,6 +10,9 @@ concurrency:
   group: licenses-${{ format('{0}-{1}', github.head_ref || github.run_number, github.job) }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: run
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index 08c147b29a..3ce7b5d5f3 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -10,6 +10,9 @@ concurrency:
   group: linting-${{ format('{0}-{1}', github.head_ref || github.run_number, github.job) }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: run
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index dd5d31ff0e..a2c9f200b8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,6 +12,9 @@ concurrency:
   group: tests-${{ format('{0}-{1}', github.head_ref || github.run_number, github.job) }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: ${{ matrix.target }} ${{ matrix.build_type }}