diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc3bce3..045176c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,8 @@
 name: CI
 on: [pull_request]
+permissions:
+  contents: read
+
 jobs:
     test:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 37ac504..2651ecb 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -3,6 +3,9 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+permissions:
+  contents: write
+
 jobs:
     publish:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index d73028c..ec12030 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -3,6 +3,9 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+permissions:
+  contents: read
+
 jobs:
     publish:
         runs-on: ubuntu-latest