diff --git a/.github/workflows/check-for-sysinfo.yml b/.github/workflows/check-for-sysinfo.yml
index 7a1a8142f..8ae69a36a 100644
--- a/.github/workflows/check-for-sysinfo.yml
+++ b/.github/workflows/check-for-sysinfo.yml
@@ -2,6 +2,9 @@ name: "Check for sysinfo in data files"
 
 on: [ pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   checksysinfo:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 7c535f24a..df138ad35 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -2,6 +2,9 @@ name: "FreeBSD build and test"
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   ###
   #
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index caf26aca6..b36c9c9c8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,6 +2,9 @@ name: "Build and test"
 
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 env:
   CFLAGS: "-Werror -Wno-error=missing-field-initializers"
   UBUNTU_PACKAGES: libgudev-1.0-dev libxml++2.6-dev valgrind tree python3-pip python3-setuptools libevdev-dev
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 195003c43..7588a3af1 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 env:
   UBUNTU_PACKAGES: libgudev-1.0-dev libxml++2.6-dev valgrind tree python3-pip python3-setuptools libevdev-dev doxygen
   PIP_PACKAGES: meson ninja libevdev pyudev pytest yq
@@ -12,6 +15,8 @@ env:
 jobs:
   deploy:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v3
       - uses: ./.github/actions/pkginstall