diff --git a/.github/workflows/automatic-updates.yml b/.github/workflows/automatic-updates.yml
index 0a39265..0543d7f 100644
--- a/.github/workflows/automatic-updates.yml
+++ b/.github/workflows/automatic-updates.yml
@@ -4,10 +4,14 @@ on:
   schedule:
     - cron: "*/15 * * * *"
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'rocketchat'
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index fad9ee9..8819c27 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -19,10 +19,15 @@ on:
       - compose.yml
       - ".github/workflows/build-test.yml"
 
+permissions: {}
+
 jobs:
   gen-matrix:
     name: generate-matrix
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
 
     steps:
       - name: Checkout
@@ -57,6 +62,8 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.gen-matrix.outputs.matrix) }}
diff --git a/.github/workflows/official-pr.yml b/.github/workflows/official-pr.yml
index a063ca8..4a6a9f3 100644
--- a/.github/workflows/official-pr.yml
+++ b/.github/workflows/official-pr.yml
@@ -11,11 +11,14 @@ on:
       - "!templates/**"
       - "stackbrew.js"
 
+permissions: {}
+
 jobs:
   pr:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'rocketchat' && github.event.pull_request.merged_by != ''
     permissions:
+      contents: read
       pull-requests: write
 
     steps: