diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index afe17b309..6033555dc 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -5,6 +5,10 @@ on:
     paths:
       - '.github/project.yml'
 
+permissions:
+  contents: read
+  pull-requests: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/quarkus-snapshot.yaml b/.github/workflows/quarkus-snapshot.yaml
index 82bac6e79..09b3d575e 100644
--- a/.github/workflows/quarkus-snapshot.yaml
+++ b/.github/workflows/quarkus-snapshot.yaml
@@ -18,6 +18,17 @@ env:
 
   ECOSYSTEM_CI_REPO_PATH: quarkus-openapi-generator
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   build:
     name: "Build against latest Quarkus snapshot"
diff --git a/.github/workflows/release-prepare.yml b/.github/workflows/release-prepare.yml
index aedad9370..02ada9287 100644
--- a/.github/workflows/release-prepare.yml
+++ b/.github/workflows/release-prepare.yml
@@ -6,6 +6,9 @@ on:
     paths:
       - '.github/project.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true