diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1f97f9..67d09f8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,13 @@
 name: CI
 on:
+  push:
+    branches:
+      - main
   pull_request:
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   CI:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index c73a9fe..42af1ac 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: 0 0 * * *
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   Coverage:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/spec_update.yml b/.github/workflows/spec_update.yml
index 17ae5aa..63c10d9 100644
--- a/.github/workflows/spec_update.yml
+++ b/.github/workflows/spec_update.yml
@@ -4,6 +4,9 @@ on:
   repository_dispatch:
     types: [spec_update]
 
+permissions:  # least privilege; PR creation uses the SPEC_UPDATE_TOKEN PAT
+  contents: read
+
 jobs:
   Update:
     runs-on: ubuntu-latest