diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ba48541..cc6c511 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -4,6 +4,10 @@ on:
   pull_request:
     branches: [ master ]
 
+
+permissions:
+  contents: read
+
 name: Check
 
 jobs:
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index d6868c6..8186e29 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -3,6 +3,10 @@ on:
     branches:
       - master
 
+
+permissions:
+  contents: write
+
 name: Package
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6836121..ec399c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,11 @@ on:
     tags:
       - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
 
+
+permissions:
+  contents: read
+  releases: write
+
 name: Create Release
 
 jobs: