diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index 43e1489e..a6657d71 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -2,6 +2,9 @@ name: C/C++ CI
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/cross-platform-actions.yml b/.github/workflows/cross-platform-actions.yml
index 8864bb74..2ab0980b 100644
--- a/.github/workflows/cross-platform-actions.yml
+++ b/.github/workflows/cross-platform-actions.yml
@@ -2,6 +2,9 @@ name: BSD, Haiku, OmniOS CI
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/msys2.yml b/.github/workflows/msys2.yml
index e8eeff21..264e559f 100644
--- a/.github/workflows/msys2.yml
+++ b/.github/workflows/msys2.yml
@@ -2,6 +2,9 @@ name: MSYS2 CI
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/uncrustify.yml b/.github/workflows/uncrustify.yml
index b68e4a54..2c54a422 100644
--- a/.github/workflows/uncrustify.yml
+++ b/.github/workflows/uncrustify.yml
@@ -2,6 +2,9 @@ name: Uncrustify
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   uncrustify:
     runs-on: ubuntu-slim