diff --git a/.github/workflows/audit-javascript.yml b/.github/workflows/audit-javascript.yml
index 66aff2b7f..9411e329c 100644
--- a/.github/workflows/audit-javascript.yml
+++ b/.github/workflows/audit-javascript.yml
@@ -29,6 +29,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   audit-js:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/audit-rust.yml b/.github/workflows/audit-rust.yml
index e1e4ef1c9..cc7e79990 100644
--- a/.github/workflows/audit-rust.yml
+++ b/.github/workflows/audit-rust.yml
@@ -29,6 +29,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   audit-rust:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/check-change-files.yml b/.github/workflows/check-change-files.yml
index 0a2098089..1392d093b 100644
--- a/.github/workflows/check-change-files.yml
+++ b/.github/workflows/check-change-files.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/check-generated-files.yml b/.github/workflows/check-generated-files.yml
index 9ce88d2a4..480311f89 100644
--- a/.github/workflows/check-generated-files.yml
+++ b/.github/workflows/check-generated-files.yml
@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/check-license-header.yml b/.github/workflows/check-license-header.yml
index a7ac28ea3..efe95bea7 100644
--- a/.github/workflows/check-license-header.yml
+++ b/.github/workflows/check-license-header.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/covector-status.yml b/.github/workflows/covector-status.yml
index a27720654..d8b44acea 100644
--- a/.github/workflows/covector-status.yml
+++ b/.github/workflows/covector-status.yml
@@ -5,6 +5,9 @@
 name: covector status
 on: [pull_request]
 
+permisisons:
+  contents: read
+
 jobs:
   covector:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/fmt.yml b/.github/workflows/fmt.yml
index 780928b70..4f09cdf91 100644
--- a/.github/workflows/fmt.yml
+++ b/.github/workflows/fmt.yml
@@ -7,6 +7,9 @@ name: check formatting
 on:
   pull_request:
 
+permisisons:
+  contents: read
+
 jobs:
   rustfmt:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 941e6d883..d9e14b527 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -21,6 +21,9 @@ on:
       - '.github/workflows/integration-tests.yml'
       - 'plugins/updater/src/**'
 
+permisisons:
+  contents: read
+
 jobs:
   run-integration-tests:
     runs-on: ${{ matrix.platform }}
diff --git a/.github/workflows/lint-javascript.yml b/.github/workflows/lint-javascript.yml
index be7ffaaaa..1e3f2309f 100644
--- a/.github/workflows/lint-javascript.yml
+++ b/.github/workflows/lint-javascript.yml
@@ -32,6 +32,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   eslint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint-rust.yml b/.github/workflows/lint-rust.yml
index 4119fa13a..55c24e094 100644
--- a/.github/workflows/lint-rust.yml
+++ b/.github/workflows/lint-rust.yml
@@ -28,6 +28,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 50ac5497e..46c49d43f 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   sync-to-mirrors:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-android.yml b/.github/workflows/test-android.yml
index 2c0f3f4f0..a9973a4b4 100644
--- a/.github/workflows/test-android.yml
+++ b/.github/workflows/test-android.yml
@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.platform }}
diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
index f7c005ff2..7724a7d2b 100644
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@@ -30,6 +30,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permisisons:
+  contents: read
+
 jobs:
   changes:
     runs-on: ubuntu-latest