diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 96acc4a61e..c30a7f46a1 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -14,6 +14,9 @@ on:
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/example.yml b/.github/workflows/example.yml
index 5fe0480897..f969da831b 100644
--- a/.github/workflows/example.yml
+++ b/.github/workflows/example.yml
@@ -11,6 +11,9 @@ on:
     paths:
       - 'examples/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/java.yml b/.github/workflows/java.yml
index 353b25f2d1..5c87ac265c 100644
--- a/.github/workflows/java.yml
+++ b/.github/workflows/java.yml
@@ -27,6 +27,9 @@ on:
 env:
   MAVEN_OPTS: -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/python-extension.yml b/.github/workflows/python-extension.yml
index 0a88368995..b8c63711e1 100644
--- a/.github/workflows/python-extension.yml
+++ b/.github/workflows/python-extension.yml
@@ -20,6 +20,9 @@ on:
       - 'pom.xml'
       - 'python/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 80598cf704..0ebba2e701 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -26,6 +26,9 @@ env:
   JAI_CODEC_VERSION: "1.1.3"
   JAI_IMAGEIO_VERSION: "1.1"
 
+permissions:
+  contents: read
+
 jobs:
   build: