diff --git a/.github/workflows/codestyle.yml b/.github/workflows/codestyle.yml
index bff498ba89c..d3e224111c0 100644
--- a/.github/workflows/codestyle.yml
+++ b/.github/workflows/codestyle.yml
@@ -6,6 +6,9 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   php:
     name: PHP
diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml
index 943cd658784..d9c4014c1df 100644
--- a/.github/workflows/javascript.yml
+++ b/.github/workflows/javascript.yml
@@ -10,6 +10,9 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   syntax:
     name: "Check Syntax"
diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml
index 8bdadf24259..87c86894047 100644
--- a/.github/workflows/php.yml
+++ b/.github/workflows/php.yml
@@ -14,6 +14,9 @@ on:
     paths:
     - '*.php'
 
+permissions:
+  contents: read
+
 jobs:
   syntax:
     name: "Check Syntax (${{ matrix.php }})"
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 0facc2bd753..6d94faff556 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -10,6 +10,10 @@ on:
     - ready_for_review
     - review_requested
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   commit_message:
     name: Check Commit Message
diff --git a/.github/workflows/templates.yml b/.github/workflows/templates.yml
index 4410c4fc723..55e3440b59c 100644
--- a/.github/workflows/templates.yml
+++ b/.github/workflows/templates.yml
@@ -10,6 +10,9 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     name: Check for differing synced templates.
diff --git a/.github/workflows/typescript.yml b/.github/workflows/typescript.yml
index 6d6ed7f35ba..53b2a50d97a 100644
--- a/.github/workflows/typescript.yml
+++ b/.github/workflows/typescript.yml
@@ -8,6 +8,9 @@ on:
     - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   tsc:
     name: "TSC"
diff --git a/.github/workflows/version_check.yml b/.github/workflows/version_check.yml
index 27bffae5c3d..dc483ade878 100644
--- a/.github/workflows/version_check.yml
+++ b/.github/workflows/version_check.yml
@@ -6,6 +6,9 @@ on:
     - 'com.woltlab.wcf/package.xml'
     - 'wcfsetup/install/files/lib/system/WCF.class.php'
 
+permissions:
+  contents: read
+
 jobs:
   wcf_version:
     name: "Check that WCF_VERSION is in sync"