diff --git a/.github/workflows/pre-commit_ci.yaml b/.github/workflows/pre-commit_ci.yaml
index 9580ad0..4ff2b78 100644
--- a/.github/workflows/pre-commit_ci.yaml
+++ b/.github/workflows/pre-commit_ci.yaml
@@ -2,6 +2,10 @@ name: Pre Commit CI
 
 on: pull_request
 
+permissions:
+  contents: read
+
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pre-release.yaml b/.github/workflows/pre-release.yaml
index 498c52f..4b72c51 100644
--- a/.github/workflows/pre-release.yaml
+++ b/.github/workflows/pre-release.yaml
@@ -4,6 +4,9 @@ on:
   release:
     types: [prereleased]
 
+permissions:
+  contents: read
+
 jobs:
   pre-release-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 91bf710..d3395e4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,6 +4,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   release-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 0d84e9c..16e2f05 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -2,6 +2,9 @@ name: Test code
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest