diff --git a/.github/workflows/ci-pull_request.yml b/.github/workflows/ci-pull_request.yml
index 78e96ca9a6..fb39a503d6 100644
--- a/.github/workflows/ci-pull_request.yml
+++ b/.github/workflows/ci-pull_request.yml
@@ -16,6 +16,9 @@ on:
       - "[0-9]+.[0-9]+"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   GOEXPERIMENT: jsonv2 # required by trivy v0.69.3+ (encoding/json/v2)
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d760deedf7..c4e74bb8d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,9 @@ on:
       - "[0-9]+.[0-9]+"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml
index 3bce363cda..7b97b0ebaf 100644
--- a/.github/workflows/packaging.yml
+++ b/.github/workflows/packaging.yml
@@ -11,6 +11,9 @@ on:
       - main
       - "[0-9]+.[0-9]+"
 
+permissions:
+  contents: read
+
 env:
   DEV: true
   SNAPSHOT: true
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index a5db0f50be..484d984b08 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -14,6 +14,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   K8S_MANIFEST_DIR: deploy