diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index f14dcde8..31bd0e63 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -26,6 +26,8 @@ concurrency:
   group: ${{ github.event.pull_request.number || github.ref }}-integration
   cancel-in-progress: true
 
+permissions:
+  contents: read
 
 jobs:
     tests:
diff --git a/.github/workflows/linter.yaml b/.github/workflows/linter.yaml
index c7b91594..254524fc 100644
--- a/.github/workflows/linter.yaml
+++ b/.github/workflows/linter.yaml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.event.pull_request.number || github.ref }}-linter
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   dotnet-format:
     runs-on: windows-latest
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index 228297d5..1519ad93 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.event.pull_request.number || github.ref }}-spellcheck
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-spelling:
     runs-on: ubuntu-latest