diff --git a/.github/workflows/changed_files.yml b/.github/workflows/changed_files.yml
index 18963c60d62..3b74f1696e0 100644
--- a/.github/workflows/changed_files.yml
+++ b/.github/workflows/changed_files.yml
@@ -3,6 +3,9 @@ name: List files changed as GitHub comment
 on:
   pull_request
 
+permissions:
+  contents: read
+
 jobs:
   list-files-changed:
     if: github.event.pull_request.head.repo.full_name == github.repository
diff --git a/.github/workflows/cross-version-links.yml b/.github/workflows/cross-version-links.yml
index 3a10e067f37..ac0cb82b42a 100644
--- a/.github/workflows/cross-version-links.yml
+++ b/.github/workflows/cross-version-links.yml
@@ -7,6 +7,9 @@ on:
       - 'src/current/**/*.md'
       - 'src/current/_includes/**/*.md'
 
+permissions:
+  contents: read
+
 jobs:
   check-cross-version-links:
     name: Check for cross-version links
diff --git a/.github/workflows/validate-branch-existence.yml b/.github/workflows/validate-branch-existence.yml
index abaadd47566..3bc764b3f0d 100644
--- a/.github/workflows/validate-branch-existence.yml
+++ b/.github/workflows/validate-branch-existence.yml
@@ -15,6 +15,9 @@ on:
     - cron: '0 7 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate-branch-existence:
     name: Check crdb_branch_name entries against generated-diagrams