diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66b57543..747d32c9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
     pull_request:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     lint:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/update-go.yml b/.github/workflows/update-go.yml
index acef477b..752cdc82 100644
--- a/.github/workflows/update-go.yml
+++ b/.github/workflows/update-go.yml
@@ -5,6 +5,9 @@ on:
         - cron: "0 2 * * 1"
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     update:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/update-pnpm.yml b/.github/workflows/update-pnpm.yml
index 1355e6f9..4b325a3d 100644
--- a/.github/workflows/update-pnpm.yml
+++ b/.github/workflows/update-pnpm.yml
@@ -5,6 +5,9 @@ on:
         - cron: "0 2 1 * *"
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     update:
         runs-on: ubuntu-latest