diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000..5f055349
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Default owners for everything in the repo
+* @rhuanbarreto
diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index d6fbad55..41b84ddd 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -9,8 +9,7 @@ on:
         description: "Release tag to build (e.g. v0.1.0)"
         required: true
 
-permissions:
-  contents: write
+permissions: {}
 
 env:
   ARCHGATE_TELEMETRY: "0"
@@ -19,6 +18,8 @@ jobs:
   build:
     name: Build ${{ matrix.artifact }}
     timeout-minutes: 15
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c203741b..7165062f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,12 +11,7 @@ concurrency:
   group: release-${{ github.ref_name }}
   cancel-in-progress: false
 
-permissions:
-  actions: write
-  contents: write
-  id-token: write
-  pull-requests: write
-  statuses: write
+permissions: {}
 
 env:
   ARCHGATE_TELEMETRY: "0"
@@ -26,6 +21,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Context check
+    permissions:
+      contents: read
     outputs:
       continue: ${{ steps.check.outputs.continue }}
       workflow: ${{ steps.check.outputs.workflow }}
@@ -64,6 +61,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Pull request
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+      statuses: write
     needs: check
     if: needs.check.outputs.workflow == 'pull-request'
     steps:
@@ -114,6 +116,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     name: Release
+    permissions:
+      contents: write
+      id-token: write
     needs: check
     if: needs.check.outputs.workflow == 'release'
     steps:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b30b6bc1..79387bad 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -11,9 +11,6 @@ on:
 
 permissions: read-all
 
-env:
-  ARCHGATE_TELEMETRY: "0"
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true