diff --git a/.github/workflows/lint-javascript.yml b/.github/workflows/lint-javascript.yml
index c075f495269..e5bd61784f9 100644
--- a/.github/workflows/lint-javascript.yml
+++ b/.github/workflows/lint-javascript.yml
@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint Javascript
diff --git a/.github/workflows/lint-kotlin.yml b/.github/workflows/lint-kotlin.yml
index 8e0c59a2cb8..376965509b5 100644
--- a/.github/workflows/lint-kotlin.yml
+++ b/.github/workflows/lint-kotlin.yml
@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
   pull_request:
 
+
+permissions:
+  contents: read
+
 jobs:
   ktlint:
     name: Lint Kotlin
diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml
index 1d27aeae209..95af1892080 100644
--- a/.github/workflows/lint-php.yml
+++ b/.github/workflows/lint-php.yml
@@ -8,6 +8,10 @@ on:  # yamllint disable-line rule:truthy
       - ".github/linters/phpcs.xml"
       - ".github/workflows/php-lint.yml"
 
+
+permissions:
+  contents: read
+
 jobs:
   phpcs:
     name: "PHP Linter"
diff --git a/.github/workflows/lint-ruby.yml b/.github/workflows/lint-ruby.yml
index b8ef856ea5f..1a1f99d0a26 100644
--- a/.github/workflows/lint-ruby.yml
+++ b/.github/workflows/lint-ruby.yml
@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 jobs:
   rubocop:
     name: RuboCop
diff --git a/.github/workflows/writeme.yml b/.github/workflows/writeme.yml
index 865e73687e4..f346ad0d41e 100644
--- a/.github/workflows/writeme.yml
+++ b/.github/workflows/writeme.yml
@@ -11,6 +11,10 @@ on:  # yamllint disable-line rule:truthy
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"
diff --git a/.github/workflows/yaml-lint.yml b/.github/workflows/yaml-lint.yml
index cf767fa774e..4a10e9ac420 100644
--- a/.github/workflows/yaml-lint.yml
+++ b/.github/workflows/yaml-lint.yml
@@ -4,6 +4,10 @@ on:  # yamllint disable-line rule:truthy
   pull_request:
   workflow_dispatch:
 
+
+permissions:
+  contents: read
+
 jobs:
   yamllint:
     name: Lint Yaml