diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 509fb3bc7..3a22e1f3a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,6 +1,9 @@
 name: Lint
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   xml-linters:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index e3ff20ef9..fea0e8dd5 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -7,6 +7,9 @@ on:
             - main
             - stable*
 
+permissions:
+  contents: read
+
 jobs:
   release-tarball:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index cf52dda2c..eb9d50632 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -7,6 +7,9 @@ on:
       - main
       - stable*
 
+permissions:
+  contents: read
+
 jobs:
   static-psalm-analysis:
       runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e29d1e378..9e7ea8a31 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,6 +7,9 @@ on:
       - main
       - stable*
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest