diff --git a/.github/workflows/license-header-check.yml b/.github/workflows/license-header-check.yml
index 1cf250c..ff9c583 100644
--- a/.github/workflows/license-header-check.yml
+++ b/.github/workflows/license-header-check.yml
@@ -12,6 +12,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   license-header-check:
     name: License Header Check
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6e7e934..989893b 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,6 +11,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/snyk-scan-edge-npm-pr.yml b/.github/workflows/snyk-scan-edge-npm-pr.yml
index 883a636..daef2b3 100644
--- a/.github/workflows/snyk-scan-edge-npm-pr.yml
+++ b/.github/workflows/snyk-scan-edge-npm-pr.yml
@@ -10,6 +10,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   snyk-scan-edge-npm-pr:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/snyk-scan-npm-pr.yml b/.github/workflows/snyk-scan-npm-pr.yml
index 3c7a0c6..be2cdb1 100644
--- a/.github/workflows/snyk-scan-npm-pr.yml
+++ b/.github/workflows/snyk-scan-npm-pr.yml
@@ -10,6 +10,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   snyk-scan-npm-pr:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/yarn-scan-cypress-pr.yml b/.github/workflows/yarn-scan-cypress-pr.yml
index 0f34408..c49d3c4 100644
--- a/.github/workflows/yarn-scan-cypress-pr.yml
+++ b/.github/workflows/yarn-scan-cypress-pr.yml
@@ -10,6 +10,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   yarn-scan-cypress-pr:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/yarn-scan-pr.yml b/.github/workflows/yarn-scan-pr.yml
index bc72b88..bc0cf75 100644
--- a/.github/workflows/yarn-scan-pr.yml
+++ b/.github/workflows/yarn-scan-pr.yml
@@ -10,6 +10,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   yarn-scan-pr:
     runs-on: ubuntu-latest