diff --git a/.github/workflows/code-pull-request.yml b/.github/workflows/code-pull-request.yml
index 211d47b0..7662fc9b 100644
--- a/.github/workflows/code-pull-request.yml
+++ b/.github/workflows/code-pull-request.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/update-lock.yaml b/.github/workflows/update-lock.yaml
index 2592dce5..25e6d54a 100644
--- a/.github/workflows/update-lock.yaml
+++ b/.github/workflows/update-lock.yaml
@@ -6,9 +6,13 @@ on:
     paths:
       - "package.json"
       - ".github/workflows/update-lock.yaml"
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
+
 jobs:
   update-lock:
     name: Update Package Lock
diff --git a/.github/workflows/windows-smoke-test.yml b/.github/workflows/windows-smoke-test.yml
index 8bd6a943..904cf245 100644
--- a/.github/workflows/windows-smoke-test.yml
+++ b/.github/workflows/windows-smoke-test.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true