diff --git a/.github/workflows/tfg-main-pypi.yml b/.github/workflows/tfg-main-pypi.yml
index 741dc116e..e203d4ae3 100644
--- a/.github/workflows/tfg-main-pypi.yml
+++ b/.github/workflows/tfg-main-pypi.yml
@@ -3,6 +3,9 @@ name: Deploy tensorflow_graphics to pypi
 
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     if: github.repository == 'tensorflow/graphics'  # prevents action from running on forks
diff --git a/.github/workflows/tfg-nightly-pypi.yml b/.github/workflows/tfg-nightly-pypi.yml
index c77d40483..e29e902d7 100644
--- a/.github/workflows/tfg-nightly-pypi.yml
+++ b/.github/workflows/tfg-nightly-pypi.yml
@@ -7,6 +7,9 @@ on:
     # runs daily at 00:30 am
     - cron:  '30 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     if: github.repository == 'tensorflow/graphics'  # prevents action from running on forks
diff --git a/.github/workflows/tfg-test-pypi.yml b/.github/workflows/tfg-test-pypi.yml
index bd7496b0a..85c035953 100644
--- a/.github/workflows/tfg-test-pypi.yml
+++ b/.github/workflows/tfg-test-pypi.yml
@@ -3,6 +3,9 @@ name: Deploy to test-pypi
 
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     if: github.repository == 'tensorflow/graphics'  # prevents action from running on forks