diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 60b336e..2bd9068 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  actions: write
+  contents: read
+
 jobs:
   basic:
     name: Run tests
diff --git a/.github/workflows/initiate_release.yaml b/.github/workflows/initiate_release.yaml
index 88c7db7..839811e 100755
--- a/.github/workflows/initiate_release.yaml
+++ b/.github/workflows/initiate_release.yaml
@@ -7,6 +7,10 @@ on:
         description: 'The new version number. Example: 1.40.1'
         required: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   init_release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6646e67..c0f66d6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -6,6 +6,10 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   Release:
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'release-')
diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml
index 5674995..bd4a5be 100644
--- a/.github/workflows/reviewdog.yml
+++ b/.github/workflows/reviewdog.yml
@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   reviewdog:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/skip-ci-on-release.yml b/.github/workflows/skip-ci-on-release.yml
index b27bfbc..32f4f02 100644
--- a/.github/workflows/skip-ci-on-release.yml
+++ b/.github/workflows/skip-ci-on-release.yml
@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   reviewdog:
     runs-on: ubuntu-latest