diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml
index a2cec71..42d06d1 100644
--- a/.github/workflows/cred-scan.yml
+++ b/.github/workflows/cred-scan.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   cred-scan:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml
index 9e830ed..709617e 100644
--- a/.github/workflows/github-sanity-scan.yml
+++ b/.github/workflows/github-sanity-scan.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   github-sanity-scan:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release-osc-api.yml b/.github/workflows/release-osc-api.yml
index 47279df..2c66770 100644
--- a/.github/workflows/release-osc-api.yml
+++ b/.github/workflows/release-osc-api.yml
@@ -3,6 +3,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   osc-api-deploy:
     runs-on: ubuntu-latest