diff --git a/.github/workflows/auto_merge.yml b/.github/workflows/auto_merge.yml
index 471e93b..25db3d0 100644
--- a/.github/workflows/auto_merge.yml
+++ b/.github/workflows/auto_merge.yml
@@ -1,5 +1,8 @@
 name: auto-merge
 
+permissions:
+  contents: read
+
 on:
   pull_request:
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index f250142..0db0bd6 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,5 +1,8 @@
 name: docs
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa5f494..d0b2a6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,8 @@
 name: release
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 777422f..cba0572 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,5 +1,8 @@
 name: test
 
+permissions:
+  contents: read
+
 on: push
 
 jobs:
@@ -20,17 +23,17 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ['3.10', '3.11', '3.12', '3.13']
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v4
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: make install-test
-    - name: Run tests
-      run: pytest -x
+      - uses: actions/checkout@v4
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: make install-test
+      - name: Run tests
+        run: pytest -x
 
   coverage:
     runs-on: ubuntu-latest