diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index f1ef1ddc..1dd67a65 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   analysis:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index fa058fcb..0a780a6b 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ${{ matrix.platform.os }}
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 146aae1b..3f7e1836 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -3,6 +3,9 @@ name: Pull Request Checks
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   call-integration-tests:
     name: Run Integration Tests
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 5f48c1e8..8910a868 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: master
 
+permissions:
+  contents: read
+
 jobs:
   call-integration-tests:
     name: Run Integration Tests
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index e3776d39..cf250b94 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -3,6 +3,10 @@ name: Repo Sync
 on:
   workflow_dispatch:     # allows triggering this manually through the Actions UI
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   repo-sync:
     name: Repo Sync