diff --git a/.github/workflows/ci-protobuf.yml b/.github/workflows/ci-protobuf.yml
index 4a1c805..b2c42cd 100644
--- a/.github/workflows/ci-protobuf.yml
+++ b/.github/workflows/ci-protobuf.yml
@@ -1,5 +1,7 @@
 name: CI ProtoBuf
 
+permissions:
+  contents: read
 on:
   pull_request:
 
diff --git a/.github/workflows/golangci_lint.yml b/.github/workflows/golangci_lint.yml
index a03a451..0292a44 100644
--- a/.github/workflows/golangci_lint.yml
+++ b/.github/workflows/golangci_lint.yml
@@ -5,6 +5,8 @@ on: [pull_request]
 jobs:
   detect-modules:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       modules: ${{ steps.set-modules.outputs.modules }}
     steps:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7ff68cc..78158db 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,6 @@
 name: Build and Test
+permissions:
+  contents: read
 
 on: [pull_request]