diff --git a/.github/workflows/ci-bun.yml b/.github/workflows/ci-bun.yml
index 9806f055..4c170e81 100644
--- a/.github/workflows/ci-bun.yml
+++ b/.github/workflows/ci-bun.yml
@@ -9,6 +9,9 @@ on:
         branches:
             - main
 
+permissions:
+  contents: read
+
 jobs:
     ci-bun:
         uses: eslint/workflows/.github/workflows/ci-bun.yml@main
diff --git a/.github/workflows/ci-package-manager.yml b/.github/workflows/ci-package-manager.yml
index d369788c..819fcd17 100644
--- a/.github/workflows/ci-package-manager.yml
+++ b/.github/workflows/ci-package-manager.yml
@@ -9,6 +9,9 @@ on:
         branches:
             - main
 
+permissions:
+  contents: read
+
 jobs:
     ci-package-manager:
         uses: eslint/workflows/.github/workflows/ci-package-manager.yml@main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c6d7f7a1..0e8cc9ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
     pull_request:
         branches:
             - main
+
+permissions:
+  contents: read
+
 jobs:
     verify_files:
         name: Verify Files
diff --git a/.github/workflows/update-readme.yml b/.github/workflows/update-readme.yml
index 96d09866..3470806a 100644
--- a/.github/workflows/update-readme.yml
+++ b/.github/workflows/update-readme.yml
@@ -6,6 +6,9 @@ on:
 
     workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
     update-readme:
         uses: eslint/workflows/.github/workflows/update-readme.yml@main