diff --git a/.github/workflows/build-quick.yml b/.github/workflows/build-quick.yml
index ff4a25e19..bf3afa231 100644
--- a/.github/workflows/build-quick.yml
+++ b/.github/workflows/build-quick.yml
@@ -20,6 +20,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # We may have a self-hosted runner available for macOS. Use it if so.
   determine-macos-runner:
diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index a48bb8ef9..4e7eac101 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -30,6 +30,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}-${{ github.event.inputs.mavenPublish }}-release
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # We may have a self-hosted runner available for macOS. Use it if so.
   determine-macos-runner:
diff --git a/.github/workflows/update_gradle_wrapper.yml b/.github/workflows/update_gradle_wrapper.yml
index e928ae4f8..37f0b9722 100644
--- a/.github/workflows/update_gradle_wrapper.yml
+++ b/.github/workflows/update_gradle_wrapper.yml
@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   update-gradle-wrapper:
     runs-on: ubuntu-latest