diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 7b3e009c..cab711f8 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -7,6 +7,7 @@ on:
       - "*"
 
 permissions:
+  contents: read
   pages: write
   id-token: write
 
diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index f03a1a0a..63991ed7 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -7,6 +7,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   revert:
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index 6bb02938..2076da2b 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -7,6 +7,9 @@ on:
     paths:
       - ".github/project.yml"
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{github.workflow}}-${{github.ref}}
   cancel-in-progress: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a6e1b64..dbdd43e7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,9 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c91ed567..41603fbb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,6 +11,9 @@ on:
       - "*.txt"
       - ".all-contributorsrc"
 
+permissions:
+  contents: read
+
 env:
   JAVA_MIN: "17"
   JAVA_MAX: "25"