diff --git a/.github/workflows/dev-containers.yml b/.github/workflows/dev-containers.yml
index b635d259c..f1e9b9383 100644
--- a/.github/workflows/dev-containers.yml
+++ b/.github/workflows/dev-containers.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   cli:
     name: CLI
diff --git a/.github/workflows/publish-dev-containers.yml b/.github/workflows/publish-dev-containers.yml
index 3dcea343b..2b59b331e 100644
--- a/.github/workflows/publish-dev-containers.yml
+++ b/.github/workflows/publish-dev-containers.yml
@@ -5,6 +5,10 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-docker-v20.yml b/.github/workflows/test-docker-v20.yml
index e38817420..3282576cf 100644
--- a/.github/workflows/test-docker-v20.yml
+++ b/.github/workflows/test-docker-v20.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   test-docker-v20:
     name: Docker v20.10 Compatibility
diff --git a/.github/workflows/test-docker-v29.yml b/.github/workflows/test-docker-v29.yml
index 1c5ebad17..244a9658f 100644
--- a/.github/workflows/test-docker-v29.yml
+++ b/.github/workflows/test-docker-v29.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   test-docker-v29:
     name: Docker v29.0.0 Compatibility
diff --git a/.github/workflows/test-plan-item-validator.yml b/.github/workflows/test-plan-item-validator.yml
index c1d218aba..9c9739b6f 100644
--- a/.github/workflows/test-plan-item-validator.yml
+++ b/.github/workflows/test-plan-item-validator.yml
@@ -3,6 +3,10 @@ on:
   issues:
     types: [edited]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   main:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index 111110448..63bff3620 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -11,6 +11,10 @@ on:
   pull_request:
     branches:
       - '**'
+
+permissions:
+  contents: read
+
 jobs:
  tests-matrix:
     name: Tests Matrix (Windows)