diff --git a/.github/workflows/checkpatch.yml b/.github/workflows/checkpatch.yml
index 7d9cde4d..c9451d70 100644
--- a/.github/workflows/checkpatch.yml
+++ b/.github/workflows/checkpatch.yml
@@ -4,6 +4,9 @@ on:
     - '3.17/**'
     - '4.5/**'
 
+permissions:
+  contents: read
+
 jobs:
   checkpatch:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c049871d..5ad1dd13 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,5 +1,8 @@
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 env:
   COMPILE_CFLAGS: -Werror
   PREPARE_CFLAGS:
diff --git a/.github/workflows/tagged-release.yml b/.github/workflows/tagged-release.yml
index 624f30cd..01e64012 100644
--- a/.github/workflows/tagged-release.yml
+++ b/.github/workflows/tagged-release.yml
@@ -6,10 +6,15 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 jobs:
   tagged-release:
     name: "Tagged Release"
     runs-on: "ubuntu-latest"
+    permissions:
+      contents: write
 
     steps:
       # ...