diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 81020b6..2fd0035 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: CC0-1.0
 
 name: Codecov workflow
+permissions: read-all
 on:
   push:
     branches:
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 3700e65..bbbda52 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: CC0-1.0
 
 name: golangci-lint
+permissions: read-all
 on:
   push:
     tags:
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index 35b2b9d..7546b35 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: CC0-1.0
 
 name: SonarQube
+permissions: read-all
 on:
   push:
     branches: