diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ba4e2b39827d1..e7b3b101e6a1e 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -18,6 +18,10 @@ on:
         default: 'master'
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+
+permissions:
+  contents: read
+
 jobs:
   # This workflow contains a single job called "build"
   build:
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index d88c8f282fbbd..f4b3a1990c2ee 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -14,6 +14,10 @@ on:
     - cron: "0 5 * * *"
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+
+permissions:
+  contents: read
+
 jobs:
   # This workflow contains a single job called "build"
   check:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a89cf69beefcf..c5b5e5116e3cd 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,6 +2,10 @@ name: ❄️ Lint
 
 on: [pull_request]
 
+
+permissions:
+  contents: read
+
 jobs:
   markdownlint:
     name: 🍇 Markdown