diff --git a/.github/workflows/branch_snapshot.yml b/.github/workflows/branch_snapshot.yml
index b28fe2ea2f..f54dd3ef65 100644
--- a/.github/workflows/branch_snapshot.yml
+++ b/.github/workflows/branch_snapshot.yml
@@ -15,6 +15,9 @@ on:
         description: 'The version number to use'
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index eeec03e64a..91eada5371 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -1,6 +1,9 @@
 name: "Validate Gradle Wrapper"
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   validation:
     name: "Gradle wrapper validation"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 28d0367654..9042fafd95 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -2,6 +2,9 @@ name: PR Build
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 3279b45c04..380d5e59d9 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -6,6 +6,9 @@ on:
       - master
       - zuul-v4
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest