diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d400ec0..1e2d31b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   org-guard:
     name: Verify Repository Organization
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 3b89f03..372164a 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 7 * * *'   # Daily at 07:00 UTC
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   org-guard:
     name: Verify Repository Organization
diff --git a/.github/workflows/encryption-enforcement.yml b/.github/workflows/encryption-enforcement.yml
index ca696f8..5067e91 100644
--- a/.github/workflows/encryption-enforcement.yml
+++ b/.github/workflows/encryption-enforcement.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   encryption-tests:
     name: Encryption & Security Tests
diff --git a/.github/workflows/pii-scan.yml b/.github/workflows/pii-scan.yml
index e2d4754..2e2018d 100644
--- a/.github/workflows/pii-scan.yml
+++ b/.github/workflows/pii-scan.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   pii-scan:
     name: Scan for PII and secrets
diff --git a/.github/workflows/security-review.yml b/.github/workflows/security-review.yml
index 0862a26..6eb2e5b 100644
--- a/.github/workflows/security-review.yml
+++ b/.github/workflows/security-review.yml
@@ -9,6 +9,9 @@ on:
     - cron: '0 6 * * *'   # Daily at 06:00 UTC
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   org-guard:
     name: Verify Repository Organization
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index d039590..328abe0 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   org-guard:
     name: Verify Repository Organization
diff --git a/.github/workflows/traceability.yml b/.github/workflows/traceability.yml
index c484819..e70055d 100644
--- a/.github/workflows/traceability.yml
+++ b/.github/workflows/traceability.yml
@@ -17,6 +17,11 @@ on:
         description: 'Flag issues with no linked commit after N days'
         default: '7'
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 jobs:
   # ── 1:1 minimum — every PR/push must reference an issue ──────────────
   commit-references-issue: