diff --git a/.github/workflows/node-aught.yml b/.github/workflows/node-aught.yml
index f3cddd85..624596ff 100644
--- a/.github/workflows/node-aught.yml
+++ b/.github/workflows/node-aught.yml
@@ -2,6 +2,9 @@ name: 'Tests: node.js < 10'
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/node.yml@main
diff --git a/.github/workflows/node-pretest.yml b/.github/workflows/node-pretest.yml
index 765edf79..88d49f9b 100644
--- a/.github/workflows/node-pretest.yml
+++ b/.github/workflows/node-pretest.yml
@@ -2,6 +2,9 @@ name: 'Tests: pretest/posttest'
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/pretest.yml@main
diff --git a/.github/workflows/node-tens.yml b/.github/workflows/node-tens.yml
index b49ceb1f..ce8d325e 100644
--- a/.github/workflows/node-tens.yml
+++ b/.github/workflows/node-tens.yml
@@ -2,6 +2,9 @@ name: 'Tests: node.js >= 10'
 
 on: [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     uses: ljharb/actions/.github/workflows/node.yml@main
diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml
index 5b6d04b8..1dea3490 100644
--- a/.github/workflows/rebase.yml
+++ b/.github/workflows/rebase.yml
@@ -2,8 +2,15 @@ name: Automatic Rebase
 
 on: [pull_request_target]
 
+permissions:
+  contents: read
+
 jobs:
   _:
+    permissions:
+      contents: write  # for ljharb/rebase to push code to rebase
+      pull-requests: read  # for ljharb/rebase to get info about PR
+
     name: "Automatic Rebase"
 
     runs-on: ubuntu-latest
diff --git a/.github/workflows/require-allow-edits.yml b/.github/workflows/require-allow-edits.yml
index 7b842f89..a685b8ac 100644
--- a/.github/workflows/require-allow-edits.yml
+++ b/.github/workflows/require-allow-edits.yml
@@ -2,8 +2,14 @@ name: Require “Allow Edits”
 
 on: [pull_request_target]
 
+permissions:
+  contents: read
+
 jobs:
   _:
+    permissions:
+      pull-requests: read  # for ljharb/require-allow-edits to check 'allow edits' on PR
+
     name: "Require “Allow Edits”"
 
     runs-on: ubuntu-latest