diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index 8230a8f..89bfc3b 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -4,6 +4,9 @@ name: static analysis
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   analysis:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 9d508e3..413d2ea 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -4,6 +4,9 @@ name: tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ${{ matrix.platform.os }}
diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index 8b0c096..87b93ba 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "00 15 * * 1-5"
 
+permissions:
+  contents: read
+
 jobs:
   static-analysis:
     # Don't run the cron builds on forks
diff --git a/.github/workflows/install.yaml b/.github/workflows/install.yaml
index ed3f87b..66f0241 100644
--- a/.github/workflows/install.yaml
+++ b/.github/workflows/install.yaml
@@ -4,6 +4,9 @@ name: venv-tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ${{ matrix.platform.os }}
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index d1b7cb4..e3afd80 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -3,6 +3,9 @@ name: Pull Request Checks
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   static-analysis:
     name: Static Analysis
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index f419a6a..54cc0f7 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: master
 
+permissions:
+  contents: read
+
 jobs:
   static-analysis:
     name: Static Analysis
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index e3776d3..cf250b9 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -3,6 +3,10 @@ name: Repo Sync
 on:
   workflow_dispatch:     # allows triggering this manually through the Actions UI
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   repo-sync:
     name: Repo Sync