diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index 05343952..425f7317 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -9,6 +9,9 @@ on:
 env:
   PYTHON_VERSION_DEFAULT: "3.10"
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   docs_xml:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml
index 2306a789..0d47f12f 100644
--- a/.github/workflows/test_java.yml
+++ b/.github/workflows/test_java.yml
@@ -14,6 +14,9 @@ defaults:
   run:
     working-directory: tools
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml
index 13a3e75f..548fc0e2 100644
--- a/.github/workflows/test_js.yml
+++ b/.github/workflows/test_js.yml
@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/src/test/js
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     timeout-minutes: 30
diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml
index 24ff8d2b..655a4e6e 100644
--- a/.github/workflows/test_php.yml
+++ b/.github/workflows/test_php.yml
@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/src/test/php
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     timeout-minutes: 30
diff --git a/.github/workflows/test_proto.yml b/.github/workflows/test_proto.yml
index d33e4c28..983c388b 100644
--- a/.github/workflows/test_proto.yml
+++ b/.github/workflows/test_proto.yml
@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/src/test/proto
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     timeout-minutes: 30