diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 5b159bcfc..6adaa9337 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -1,4 +1,6 @@
 name: master
+permissions:
+  contents: read
 
 on:
   push:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index bc74b6884..cee3d166c 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,4 +1,6 @@
 name: nightly
+permissions:
+  contents: read
 on: 
   workflow_dispatch :
     branches :  
diff --git a/.github/workflows/pr-dev.yml b/.github/workflows/pr-dev.yml
index bc8c44661..5012f2632 100644
--- a/.github/workflows/pr-dev.yml
+++ b/.github/workflows/pr-dev.yml
@@ -1,4 +1,6 @@
 name: pr-dev
+permissions:
+  contents: read
 
 on:  
   pull_request:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4561839c4..0f6a0e60f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,9 @@ name: publish
 on: 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f74d42911..9d0bce721 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,6 @@
 name: release
+permissions:
+  contents: read
 
 on:
   push:
diff --git a/.github/workflows/single_app_run.yml b/.github/workflows/single_app_run.yml
index f881e15ba..dd2d2fb88 100644
--- a/.github/workflows/single_app_run.yml
+++ b/.github/workflows/single_app_run.yml
@@ -1,4 +1,6 @@
 name: single_app_run
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs: