diff --git a/.github/workflows/changesets-reminder.yml b/.github/workflows/changesets-reminder.yml
index bf70be3653..5f675d119e 100644
--- a/.github/workflows/changesets-reminder.yml
+++ b/.github/workflows/changesets-reminder.yml
@@ -23,6 +23,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   remind:
     name: Changeset Reminder
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0002e53c30..c4dc0e06af 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,9 @@ name: CI
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   type-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/internal-snapshot.yml b/.github/workflows/internal-snapshot.yml
index 564ee60ab6..5742f58982 100644
--- a/.github/workflows/internal-snapshot.yml
+++ b/.github/workflows/internal-snapshot.yml
@@ -8,6 +8,9 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   internal-snapshot:
     name: Internal Snapshot
diff --git a/.github/workflows/unstable-snapshot.yml b/.github/workflows/unstable-snapshot.yml
index bc1a57536f..9a6d2c6583 100644
--- a/.github/workflows/unstable-snapshot.yml
+++ b/.github/workflows/unstable-snapshot.yml
@@ -8,6 +8,9 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   unstable-snapshot:
     name: Unstable Snapshot