diff --git a/.github/workflows/c-check.yml b/.github/workflows/c-check.yml
index d9ed0df5c..fe09e0163 100644
--- a/.github/workflows/c-check.yml
+++ b/.github/workflows/c-check.yml
@@ -7,6 +7,9 @@ on:
   pull_request: {}
   merge_group: {}
 
+permissions:
+  contents: read
+
 jobs:
   format-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/milestone.yml b/.github/workflows/milestone.yml
index f0dc27840..04151a623 100644
--- a/.github/workflows/milestone.yml
+++ b/.github/workflows/milestone.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, edited, labeled, unlabeled, milestoned, demilestoned, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index 56d9ab8ec..acb66d1e4 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -7,6 +7,9 @@ on:
   pull_request: {}
   merge_group: {}
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: "ubuntu-latest"
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 3df481c3f..4fc749c03 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -12,6 +12,9 @@ on:
 env:
   RUSTFLAGS: "-D warnings"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: cargo:test
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 109becfd1..30bfc80a7 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -7,6 +7,9 @@ on:
   pull_request: {}
   merge_group: {}
 
+permissions:
+  contents: read
+
 jobs:
   steep:
     runs-on: "ubuntu-latest"
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 1733e7d5e..da184e05d 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -7,6 +7,9 @@ on:
   pull_request: {}
   merge_group: {}
 
+permissions:
+  contents: read
+
 jobs:
   compile:
     runs-on: "windows-latest"