diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index fcf784f..5e3a75f 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+    contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index ffe75b8..d040ab9 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+    contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/openbsd.yml b/.github/workflows/openbsd.yml
index 182f848..e16a496 100644
--- a/.github/workflows/openbsd.yml
+++ b/.github/workflows/openbsd.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+    contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index a684e9a..36125b8 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+    contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index d702c28..2a0af78 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+    contents: read
+
 jobs:
   build: