diff --git a/.github/workflows/alpine.yml b/.github/workflows/alpine.yml
index 33f4dc08884..511fad53447 100644
--- a/.github/workflows/alpine.yml
+++ b/.github/workflows/alpine.yml
@@ -10,13 +10,13 @@ on:
 env:
   IMAGE_NAME: kamailio-ci
   SOURCE_BRANCH: ${{ github.ref_name }}
-permissions:
-  contents: read
-  packages: write 
+
 jobs:
   x86_64:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      packages: write 
     steps:
     - uses: actions/checkout@v4
 
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index d376f8a1b3c..a8294516c2a 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -4,11 +4,11 @@ on:
     branches: [ "master" ]
   schedule:
     - cron: "30 0 * * *"
-permissions:
-  contents: read
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Build Fuzzers
       id: build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b6837bbdd0b..71c8e66cb6c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,8 +5,6 @@ on:
     branches: [ "master" ]
   schedule:
     - cron: "30 0 * * *"
-permissions:
-  contents: read
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 04885eaf034..8f1d028cda8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -6,11 +6,11 @@ name: build
       - master
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
-permissions:
-  contents: read # to fetch code (actions/checkout)
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to fetch code (actions/checkout)
     container:
       image: ghcr.io/kamailio/pkg-kamailio-docker:${{ github.ref_name }}-${{ matrix.distribution }}
       volumes:
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index bfba0702bdf..a2fc539ddfc 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -6,11 +6,11 @@ name: checks_pr
       - master
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
-permissions:
-  contents: read # to fetch code (actions/checkout)
 jobs:
   check-format:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to fetch code (actions/checkout)
     steps:
       - uses: actions/checkout@v4
       - uses: wolletd/clang-format-checker@v1.10
@@ -18,6 +18,8 @@ jobs:
           target-ref: master
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to fetch code (actions/checkout)
     container:
       image: ghcr.io/kamailio/pkg-kamailio-docker:master-${{ matrix.distribution }}
       volumes: