diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fb12286f0..a52632513 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,6 +18,7 @@ concurrency:
 jobs:
   lint-commit:
     name: "lint commit message"
+    permissions: {}
     runs-on: ubuntu-24.04
     if: ${{ github.event_name == 'pull_request' }}
     steps:
@@ -145,6 +146,7 @@ jobs:
     timeout-minutes: 60
   ios:
     name: "iOS"
+    permissions: {}
     runs-on: macos-15
     steps:
       - name: Checkout
@@ -198,6 +200,7 @@ jobs:
     timeout-minutes: 60
   ios-template:
     name: "iOS [template]"
+    permissions: {}
     strategy:
       matrix:
         template: [all, ios]
@@ -244,6 +247,7 @@ jobs:
     timeout-minutes: 60
   android:
     name: "Android"
+    permissions: {}
     strategy:
       matrix:
         runner: [ubuntu-24.04, windows-2025]
@@ -291,6 +295,7 @@ jobs:
     timeout-minutes: 60
   android-template:
     name: "Android [template]"
+    permissions: {}
     strategy:
       matrix:
         template: [all, android]
@@ -331,6 +336,7 @@ jobs:
     timeout-minutes: 60
   macos:
     name: "macOS"
+    permissions: {}
     runs-on: macos-15
     if: ${{ github.event_name != 'schedule' }}
     steps:
@@ -402,6 +408,7 @@ jobs:
     timeout-minutes: 60
   macos-template:
     name: "macOS [template]"
+    permissions: {}
     strategy:
       matrix:
         template: [all, macos]
@@ -443,6 +450,7 @@ jobs:
     timeout-minutes: 60
   visionos:
     name: "visionOS"
+    permissions: {}
     runs-on: macos-15
     if: ${{ github.event_name != 'schedule' }}
     steps:
@@ -492,6 +500,7 @@ jobs:
     timeout-minutes: 60
   visionos-template:
     name: "visionOS [template]"
+    permissions: {}
     strategy:
       matrix:
         template: [all, visionos]
@@ -533,6 +542,7 @@ jobs:
     timeout-minutes: 60
   windows:
     name: "Windows"
+    permissions: {}
     runs-on: windows-2025
     strategy:
       matrix:
@@ -590,6 +600,7 @@ jobs:
     timeout-minutes: 60
   windows-template:
     name: "Windows [template]"
+    permissions: {}
     runs-on: windows-2025
     if: ${{ github.event_name != 'schedule' }}
     strategy:
diff --git a/.github/workflows/rnx-build.yml b/.github/workflows/rnx-build.yml
index c5aaaf1ad..9f8b685a6 100644
--- a/.github/workflows/rnx-build.yml
+++ b/.github/workflows/rnx-build.yml
@@ -30,6 +30,7 @@ on:
 jobs:
   build-android:
     name: Build Android
+    permissions: {}
     if: ${{ github.event.inputs.platform == 'android' }}
     runs-on: ubuntu-24.04
     steps:
@@ -57,6 +58,7 @@ jobs:
           retention-days: 14
   build-ios:
     name: Build iOS
+    permissions: {}
     if: ${{ github.event.inputs.platform == 'ios' }}
     runs-on: macos-14
     env:
@@ -116,6 +118,7 @@ jobs:
           retention-days: 14
   build-macos:
     name: Build macOS
+    permissions: {}
     if: ${{ github.event.inputs.platform == 'macos' }}
     runs-on: macos-14
     steps:
@@ -150,6 +153,7 @@ jobs:
           retention-days: 14
   build-windows:
     name: Build Windows
+    permissions: {}
     if: ${{ github.event.inputs.platform == 'windows' }}
     runs-on: windows-2022
     steps:
@@ -192,6 +196,7 @@ jobs:
           retention-days: 14
   distribute:
     name: Distribute build
+    permissions: {}
     needs: [build-android, build-ios]
     runs-on: ubuntu-24.04
     if: ${{ github.event.inputs.distribution != 'local' && !cancelled() && !failure() }} # `success()` excludes skipped jobs