diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 49c59ff..bd84885 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
diff --git a/.github/workflows/client-ci.yml b/.github/workflows/client-ci.yml
index 23f9d99..63a4b10 100644
--- a/.github/workflows/client-ci.yml
+++ b/.github/workflows/client-ci.yml
@@ -11,6 +11,9 @@ on:
       - 'client/**'
       - 'packages/agent_code_client/**'
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Dart tests
diff --git a/.github/workflows/client-e2e.yml b/.github/workflows/client-e2e.yml
index cab802e..9f85e11 100644
--- a/.github/workflows/client-e2e.yml
+++ b/.github/workflows/client-e2e.yml
@@ -8,6 +8,9 @@ on:
       - 'packages/agent_code_client/**'
       - 'crates/cli/src/serve.rs'
 
+permissions:
+  contents: read
+
 jobs:
   e2e:
     name: E2E tests (agent + WebSocket + LLM)