diff --git a/.github/workflows/cpp_extra.yml b/.github/workflows/cpp_extra.yml
index 5ad06b2e011..7ab4c73270d 100644
--- a/.github/workflows/cpp_extra.yml
+++ b/.github/workflows/cpp_extra.yml
@@ -77,7 +77,9 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
+  pull-requests: read
 
 jobs:
   check-labels:
diff --git a/.github/workflows/package_linux.yml b/.github/workflows/package_linux.yml
index 20950e28882..3e4b7592153 100644
--- a/.github/workflows/package_linux.yml
+++ b/.github/workflows/package_linux.yml
@@ -61,8 +61,10 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   # Upload to GitHub Release
   contents: write
+  pull-requests: read
 
 jobs:
   check-labels:
diff --git a/.github/workflows/r_extra.yml b/.github/workflows/r_extra.yml
index 8c4ec668f49..687a4e0aa05 100644
--- a/.github/workflows/r_extra.yml
+++ b/.github/workflows/r_extra.yml
@@ -67,7 +67,9 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
+  pull-requests: read
 
 jobs:
   check-labels: