diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 9908e835d..7f9e645fa 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -138,6 +138,8 @@ jobs:
 
   ui:
     name: UI
+    permissions:
+      contents: read
     runs-on: depot-ubuntu-24.04-arm
 
     steps:
diff --git a/.github/workflows/docs-issue.yml b/.github/workflows/docs-issue.yml
index 72e45cdb5..caf307873 100644
--- a/.github/workflows/docs-issue.yml
+++ b/.github/workflows/docs-issue.yml
@@ -1,4 +1,7 @@
 name: Create Documentation Issue
+permissions:
+  issues: write
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8d6cf9983..ad580447a 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,4 +1,6 @@
 name: Nightly Build
+permissions:
+  contents: read
 
 on:
   schedule: # runs on the default branch: master
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d03196db0..881afc1d9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,8 @@ jobs:
     needs:
       - call-build-workflow
     runs-on: depot-ubuntu-24.04-arm
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index a3cd850f0..3196a4337 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -9,6 +9,10 @@ on:
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     runs-on: depot-ubuntu-24.04-arm
     steps:
       - uses: actions/stale@v9
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index 68feb9b67..6613d03f1 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -1,4 +1,6 @@
 name: Deploy data to website
+permissions:
+  contents: read
 
 on:
   release: