diff --git a/.github/workflows/rspec.yml b/.github/workflows/rspec.yml
index 8c10f68..c62eaa9 100644
--- a/.github/workflows/rspec.yml
+++ b/.github/workflows/rspec.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   rspec:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/rubocop.yml b/.github/workflows/rubocop.yml
index 54f8481..c7c6fe5 100644
--- a/.github/workflows/rubocop.yml
+++ b/.github/workflows/rubocop.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   rubocop:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml
index 84a8327..5228b2d 100644
--- a/.github/workflows/spell-check.yml
+++ b/.github/workflows/spell-check.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   spell-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/yaml-lint.yml b/.github/workflows/yaml-lint.yml
index db65913..3aca6f6 100644
--- a/.github/workflows/yaml-lint.yml
+++ b/.github/workflows/yaml-lint.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   yaml-lint:
     runs-on: ubuntu-latest