diff --git a/.github/workflows/canary_d2l.yml b/.github/workflows/canary_d2l.yml
index 68aea26e..d2c8d9d0 100644
--- a/.github/workflows/canary_d2l.yml
+++ b/.github/workflows/canary_d2l.yml
@@ -6,6 +6,9 @@ on:
     - cron:  '0 9 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   canary-test:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/colab.yml b/.github/workflows/colab.yml
index caf3f2d0..27c0d7fb 100644
--- a/.github/workflows/colab.yml
+++ b/.github/workflows/colab.yml
@@ -6,6 +6,9 @@ on:
     - cron:  '0 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   sync:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr_notebook.yml b/.github/workflows/pr_notebook.yml
index 848e2758..23d1335e 100644
--- a/.github/workflows/pr_notebook.yml
+++ b/.github/workflows/pr_notebook.yml
@@ -10,6 +10,9 @@ on:
       - "**.css"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest