diff --git a/.github/workflows/check-commits.yml b/.github/workflows/check-commits.yml
index 48cb13a7..49388949 100644
--- a/.github/workflows/check-commits.yml
+++ b/.github/workflows/check-commits.yml
@@ -10,6 +10,9 @@ on:
     branches:
       - "main"
 
+permissions:
+  contents: read
+
 jobs:
   check-commit-messages:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/python-linter.yml b/.github/workflows/python-linter.yml
index 24b524cd..0f419fcf 100644
--- a/.github/workflows/python-linter.yml
+++ b/.github/workflows/python-linter.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b0d3613a..dda8223a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+
 jobs:
   mock-tests:
     runs-on: ubuntu-latest