diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7a43aef7..f7880c6f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,6 +10,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, labeled]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 75e02296..3c5733af 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -6,6 +6,9 @@ on:
       - 'dev'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   PROJECT_NAME: finit
   CONTACT_EMAIL: troglobit@gmail.com
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f4b55dfc..3c7636b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     tags:
       - '[0-9]+.[0-9]+*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Build and upload release tarball
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
index affb1299..c53ab692 100644
--- a/.github/workflows/weekly.yml
+++ b/.github/workflows/weekly.yml
@@ -7,6 +7,9 @@ on:
     - cron: '0 0 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   schedule:
     runs-on: ubuntu-latest