diff --git a/.github/workflows/beta-docs.yaml b/.github/workflows/beta-docs.yaml
index 5ecf301ef2c..ee7045a0ce0 100644
--- a/.github/workflows/beta-docs.yaml
+++ b/.github/workflows/beta-docs.yaml
@@ -4,6 +4,9 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger-circleci:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index d8693d83060..1f07c61b253 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -1,6 +1,9 @@
 name: Manual nightly deploy
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   trigger-circleci:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/prod-docs.yaml b/.github/workflows/prod-docs.yaml
index c20ba5738b1..b679d5644b7 100644
--- a/.github/workflows/prod-docs.yaml
+++ b/.github/workflows/prod-docs.yaml
@@ -4,6 +4,9 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger-circleci:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/weekly-chromatic.yml b/.github/workflows/weekly-chromatic.yml
index 9796932604f..dc1de4ac17c 100644
--- a/.github/workflows/weekly-chromatic.yml
+++ b/.github/workflows/weekly-chromatic.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 17 * * 1' # Monday 9am PST / 10am PDT (GH Actions cron is UTC)
   workflow_dispatch: # manual trigger for testing
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest