diff --git a/.github/workflows/code-format.yml b/.github/workflows/code-format.yml
index c1afd709a3..4e650f3688 100644
--- a/.github/workflows/code-format.yml
+++ b/.github/workflows/code-format.yml
@@ -2,6 +2,9 @@ name: Code style
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/compiler-rs.yml b/.github/workflows/compiler-rs.yml
index 1433bb0008..efed0c5a5a 100644
--- a/.github/workflows/compiler-rs.yml
+++ b/.github/workflows/compiler-rs.yml
@@ -6,6 +6,9 @@ on:
 env: 
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   build_and_test:
     name: compiler-rs
diff --git a/.github/workflows/compiler.test.yml b/.github/workflows/compiler.test.yml
index f93a2a2bc3..fa2072ea89 100644
--- a/.github/workflows/compiler.test.yml
+++ b/.github/workflows/compiler.test.yml
@@ -5,6 +5,9 @@ on:
     paths:
       - 'compiler/**'
 
+permissions:
+  contents: read
+
 jobs:
   compiler-test:
     name: build
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index 1fb1849f9d..e04de1df48 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -2,6 +2,9 @@ name: License headers
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 846c329a74..08d221cda8 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -2,6 +2,9 @@ name: Linter
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/metamodel-sync.yml b/.github/workflows/metamodel-sync.yml
index be315516b8..413d78f847 100644
--- a/.github/workflows/metamodel-sync.yml
+++ b/.github/workflows/metamodel-sync.yml
@@ -6,6 +6,9 @@ on:
       - 'compiler/**'
       - 'typescript-generator/**'
 
+permissions:
+  contents: read
+
 jobs:
   build: