diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f671ee2..3e0818e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
     branches: [main]
     types: [opened, synchronize, reopened, ready_for_review]
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -25,6 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     permissions:
+      contents: read
       pull-requests: read
     if: ${{ !github.event.pull_request.draft }}
     outputs:
diff --git a/.github/workflows/wc-export-validation.yml b/.github/workflows/wc-export-validation.yml
index d587002..d925e4d 100644
--- a/.github/workflows/wc-export-validation.yml
+++ b/.github/workflows/wc-export-validation.yml
@@ -3,6 +3,9 @@ run-name: "${{ github.workflow }} (${{ github.ref_name }}): ${{ github.event.pul
 
 on: workflow_call
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
diff --git a/.github/workflows/wc-lint-format.yml b/.github/workflows/wc-lint-format.yml
index bc0df82..442510f 100644
--- a/.github/workflows/wc-lint-format.yml
+++ b/.github/workflows/wc-lint-format.yml
@@ -3,6 +3,9 @@ run-name: "${{ github.workflow }} (${{ github.ref_name }}): ${{ github.event.pul
 
 on: workflow_call
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
diff --git a/.github/workflows/wc-test.yml b/.github/workflows/wc-test.yml
index 0cb9b94..16c4531 100644
--- a/.github/workflows/wc-test.yml
+++ b/.github/workflows/wc-test.yml
@@ -8,6 +8,9 @@ on:
         description: Token for Codecov upload
         required: true
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
diff --git a/.github/workflows/wc-type-check.yml b/.github/workflows/wc-type-check.yml
index d6fec4c..622ae4e 100644
--- a/.github/workflows/wc-type-check.yml
+++ b/.github/workflows/wc-type-check.yml
@@ -3,6 +3,9 @@ run-name: "${{ github.workflow }} (${{ github.ref_name }}): ${{ github.event.pul
 
 on: workflow_call
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash