diff --git a/.github/workflows/merge_group.yml b/.github/workflows/merge_group.yml
index eb0ab102258..cf324a6f398 100644
--- a/.github/workflows/merge_group.yml
+++ b/.github/workflows/merge_group.yml
@@ -5,6 +5,9 @@ name: Merge Queue
 on:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   call-core:
     uses: ./.github/workflows/suite_core.yml
diff --git a/.github/workflows/pypi_build.yml b/.github/workflows/pypi_build.yml
index 8740e7cac5c..2b208b95ba4 100644
--- a/.github/workflows/pypi_build.yml
+++ b/.github/workflows/pypi_build.yml
@@ -25,6 +25,9 @@ on:
 env:
   TWINE_PASSWORD: ${{ secrets.PYPI_API_KEY }}
 
+permissions:
+  contents: read
+
 jobs:
   pypi-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test_hosted.yml b/.github/workflows/test_hosted.yml
index 85b8052647a..8fa077089c8 100644
--- a/.github/workflows/test_hosted.yml
+++ b/.github/workflows/test_hosted.yml
@@ -7,7 +7,10 @@ on:
         description: 'SHA to test (optional)'
         required: false
         type: string
-  
+
+permissions:
+  contents: read
+
 jobs:
   explore-linux:
     runs-on: linux-x86-n2-16