diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e063fe06f7..e676a89d0f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,6 +13,9 @@ on:
       - crl-release-*
       - pebble-release-*
 
+permissions:
+  contents: read
+
 jobs:
 
   # This check is required to merge PRs.
diff --git a/.github/workflows/nightlies-25.2.yaml b/.github/workflows/nightlies-25.2.yaml
index 16eaa69733..4271831a03 100644
--- a/.github/workflows/nightlies-25.2.yaml
+++ b/.github/workflows/nightlies-25.2.yaml
@@ -8,6 +8,9 @@ on:
 env:
   BRANCH: crl-release-25.2
 
+permissions:
+  contents: read
+
 jobs:
   resolve-sha:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightlies-25.4.yaml b/.github/workflows/nightlies-25.4.yaml
index 9aadfcf754..0606e7c12c 100644
--- a/.github/workflows/nightlies-25.4.yaml
+++ b/.github/workflows/nightlies-25.4.yaml
@@ -8,6 +8,9 @@ on:
 env:
   BRANCH: crl-release-25.4
 
+permissions:
+  contents: read
+
 jobs:
   resolve-sha:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightlies-26.1.yaml b/.github/workflows/nightlies-26.1.yaml
index 63987a00b3..1a40e2a5b7 100644
--- a/.github/workflows/nightlies-26.1.yaml
+++ b/.github/workflows/nightlies-26.1.yaml
@@ -8,6 +8,9 @@ on:
 env:
   BRANCH: crl-release-26.1
 
+permissions:
+  contents: read
+
 jobs:
   resolve-sha:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightlies-26.2.yaml b/.github/workflows/nightlies-26.2.yaml
index 82688fb314..d829286670 100644
--- a/.github/workflows/nightlies-26.2.yaml
+++ b/.github/workflows/nightlies-26.2.yaml
@@ -8,6 +8,9 @@ on:
 env:
   BRANCH: crl-release-26.2
 
+permissions:
+  contents: read
+
 jobs:
   resolve-sha:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightlies.yaml b/.github/workflows/nightlies.yaml
index 51d396a3e1..142e36c12d 100644
--- a/.github/workflows/nightlies.yaml
+++ b/.github/workflows/nightlies.yaml
@@ -5,6 +5,9 @@ on:
     - cron: '00 10 * * * ' # 10am UTC daily
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     strategy: