diff --git a/.github/workflows/deploy-to-app.yaml b/.github/workflows/deploy-to-app.yaml
index 904dafecdc..da0ffefec0 100644
--- a/.github/workflows/deploy-to-app.yaml
+++ b/.github/workflows/deploy-to-app.yaml
@@ -1,5 +1,7 @@
 # App deployments are non-production deployments to mainnet.  They are public, can be used as staging, but e.g. funds are real.
 name: Deploy to app
+permissions:
+  contents: read
 on:
   push:
     branches:
diff --git a/.github/workflows/docker-main.yaml b/.github/workflows/docker-main.yaml
index f12a48b56d..35e9cd94d3 100644
--- a/.github/workflows/docker-main.yaml
+++ b/.github/workflows/docker-main.yaml
@@ -1,4 +1,6 @@
 name: Populate docker cache
+permissions:
+  contents: read
 on:
   push:
     branches:
diff --git a/.github/workflows/reproducible.yaml b/.github/workflows/reproducible.yaml
index 0e34c30571..2c2a24dbee 100644
--- a/.github/workflows/reproducible.yaml
+++ b/.github/workflows/reproducible.yaml
@@ -4,6 +4,8 @@ name: Reproducible Docker Builds
 #   Note: This makes builds slow but is more representative of the end user experience.
 # - NOT DONE: Verify that these builds match our release artifacts.  This would correspond to third
 #   party verifiers getting consistent hashes that differ from our release.
+permissions:
+  contents: read
 on:
   push:
     branches:
diff --git a/.github/workflows/update-aggregator.yml b/.github/workflows/update-aggregator.yml
index 1dce7c8a0c..05ec0de0c0 100644
--- a/.github/workflows/update-aggregator.yml
+++ b/.github/workflows/update-aggregator.yml
@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly updates the aggregator SNS parsing code
 # and creates a PR for any changes.
 name: Update sns_aggregator candid bindings
+permissions:
+  contents: read
 on:
   schedule:
     # Check for updates on candid interface for the aggregator every monday at 3:30am.
diff --git a/.github/workflows/update-didc.yml b/.github/workflows/update-didc.yml
index 8a2e51d4b3..5168c0d37c 100644
--- a/.github/workflows/update-didc.yml
+++ b/.github/workflows/update-didc.yml
@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly checks for new `didc` releases
 # and creates a PR on new versions.
 name: didc Update
+permissions:
+  contents: read
 on:
   schedule:
     # check for new `didc` releases every tuesday at 7:30.
diff --git a/.github/workflows/update-ic-cargo-deps.yaml b/.github/workflows/update-ic-cargo-deps.yaml
index 77e86d00ad..df5486b1ef 100644
--- a/.github/workflows/update-ic-cargo-deps.yaml
+++ b/.github/workflows/update-ic-cargo-deps.yaml
@@ -1,5 +1,7 @@
 # A GitHub Actions workflow that regularly checks for new `ic` releases and updates the Cargo.toml dependencies.
 name: Update IC Cargo Dependencies
+permissions:
+  contents: read
 on:
   schedule:
     # Check for new IC releases every Sunday at 7:30am UTC.
diff --git a/.github/workflows/update-next.yml b/.github/workflows/update-next.yml
index 989170e81a..3e8c490b83 100644
--- a/.github/workflows/update-next.yml
+++ b/.github/workflows/update-next.yml
@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that can be used to trigger updates of npm package
 # dependencies.
 name: Update next npm package dependencies
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
diff --git a/.github/workflows/update-rust.yml b/.github/workflows/update-rust.yml
index 53092359bc..0ae412afae 100644
--- a/.github/workflows/update-rust.yml
+++ b/.github/workflows/update-rust.yml
@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly checks for new Rust toolchain release
 # and creates a PR on new versions.
 name: Update rust
+permissions:
+  contents: read
 on:
   schedule:
     # check for new rust versions weekly
diff --git a/.github/workflows/update-sns-aggregator-response.yml b/.github/workflows/update-sns-aggregator-response.yml
index 823270c4cd..c6e81736cd 100644
--- a/.github/workflows/update-sns-aggregator-response.yml
+++ b/.github/workflows/update-sns-aggregator-response.yml
@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly fetches the production response
 # of the SNS aggregator and updates the mock files for the ProdLaunchpad.spec test.
 name: Update the SNS aggregator response for ProdLaunchpad.spec
+permissions:
+  contents: read
 on:
   schedule:
     - cron: "30 3 * * THU"
diff --git a/.github/workflows/update-snsdemo.yml b/.github/workflows/update-snsdemo.yml
index 104804164a..6c69514e5e 100644
--- a/.github/workflows/update-snsdemo.yml
+++ b/.github/workflows/update-snsdemo.yml
@@ -1,6 +1,8 @@
 # A GitHub Actions workflow that regularly checks for new snsdemo commits
 # and creates a PR on finding any.
 name: Update snsdemo
+permissions:
+  contents: read
 on:
   schedule:
     # check for new snsdemo commits weekly