diff --git a/.github/workflows/badwords.yml b/.github/workflows/badwords.yml
index 0165d9bfb..06b140785 100644
--- a/.github/workflows/badwords.yml
+++ b/.github/workflows/badwords.yml
@@ -15,6 +15,8 @@ on:
     branches:
     - master
 
+permissions: {}
+
 jobs:
   check:
 
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 2b095dae7..7a7b744a5 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -20,6 +20,8 @@ on:
       - 'src/**'
       - 'include/**'
 
+permissions: {}
+
 jobs:
   codespell:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/distcheck.yml b/.github/workflows/distcheck.yml
index 15068b640..1a644ef7d 100644
--- a/.github/workflows/distcheck.yml
+++ b/.github/workflows/distcheck.yml
@@ -17,6 +17,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   maketgz-and-verify-in-tree:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/man-examples.yml b/.github/workflows/man-examples.yml
index 6f0d1e8ae..2382b670a 100644
--- a/.github/workflows/man-examples.yml
+++ b/.github/workflows/man-examples.yml
@@ -21,6 +21,8 @@ on:
       - 'docs/libcurl/opts/*.3'
       - '.github/scripts/verify-examples.pl'
 
+permissions: {}
+
 jobs:
   verify:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/synopsis.yml b/.github/workflows/synopsis.yml
index 0938f4bfc..0e7f0a6d1 100644
--- a/.github/workflows/synopsis.yml
+++ b/.github/workflows/synopsis.yml
@@ -17,6 +17,8 @@ on:
     paths:
       - 'docs/libcurl/curl_*.3'
 
+permissions: {}
+
 jobs:
   verify:
     runs-on: ubuntu-latest