diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 1471d5b..6ea1a26 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -1,4 +1,5 @@
 name: pre-commit
+permissions: read-all
 run-name: Pre commit checks for ${{ github.repository }}@${{ github.ref }}
 on:
   push: {}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 2d64fc8..07dc6d9 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -1,4 +1,5 @@
 name: security checks
+permissions: read-all
 run-name: Security checks for ${{ github.repository }}@${{ github.ref }}
 on:
   push: {}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 30d6cd1..121cdc9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,4 +1,5 @@
 name: tests
+permissions: read-all
 run-name: Tests for ${{ github.repository }}@${{ github.ref }}
 on:
   push: {}