diff --git a/.github/workflows/changelog-to-discord.yml b/.github/workflows/changelog-to-discord.yml
index 175a7ba..a12c6f9 100644
--- a/.github/workflows/changelog-to-discord.yml
+++ b/.github/workflows/changelog-to-discord.yml
@@ -6,6 +6,9 @@ on:
     paths:
       - 'docs/changelog/*.mdx'
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/changelog-to-linear.yml b/.github/workflows/changelog-to-linear.yml
index ab749fd..2e42e0f 100644
--- a/.github/workflows/changelog-to-linear.yml
+++ b/.github/workflows/changelog-to-linear.yml
@@ -6,6 +6,9 @@ on:
     paths:
       - 'docs/changelog/*.mdx'
 
+permissions:
+  contents: read
+
 jobs:
   create-tickets:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/issue-label-slack.yml b/.github/workflows/issue-label-slack.yml
index 98ae9dc..4e50418 100644
--- a/.github/workflows/issue-label-slack.yml
+++ b/.github/workflows/issue-label-slack.yml
@@ -5,6 +5,9 @@ on:
     types:
       - labeled
 
+permissions:
+  issues: write
+
 jobs:
   notify:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-merge-slack.yml b/.github/workflows/pr-merge-slack.yml
index d2eee00..aade6da 100644
--- a/.github/workflows/pr-merge-slack.yml
+++ b/.github/workflows/pr-merge-slack.yml
@@ -5,6 +5,9 @@ on:
     types: [closed]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     if: github.event.pull_request.merged == true