diff --git a/.github/workflows/build-all-and-publish.yml b/.github/workflows/build-all-and-publish.yml
index 212a434..1ed26db 100644
--- a/.github/workflows/build-all-and-publish.yml
+++ b/.github/workflows/build-all-and-publish.yml
@@ -12,6 +12,9 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     name: Linux natives (${{ matrix.arch }})
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index f7ba0e7..afec9a1 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,6 +10,12 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+  # Needed by the "Check PR"/"Comment on PR" steps, which post the preview URL
+  # when the workflow is dispatched from a non-main branch that has an open PR
+  pull-requests: write
+
 jobs:
   build:
     name: Build documentation
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0a7f30b..039f2aa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     name: Linux test