diff --git a/.github/workflows/codeberg-mirror.yml b/.github/workflows/codeberg-mirror.yml
index 82eba21..500c260 100644
--- a/.github/workflows/codeberg-mirror.yml
+++ b/.github/workflows/codeberg-mirror.yml
@@ -7,6 +7,9 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: codeberg-mirror
   cancel-in-progress: true
diff --git a/.github/workflows/distro-test-matrix.yml b/.github/workflows/distro-test-matrix.yml
index dc2cede..0ef5b2a 100644
--- a/.github/workflows/distro-test-matrix.yml
+++ b/.github/workflows/distro-test-matrix.yml
@@ -27,6 +27,9 @@ on:
       - '.github/workflows/distro-test-matrix.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Six containers a run, on a filter that any shell script matches: a second
 # push should not leave the first one's matrix running to completion.
 concurrency:
diff --git a/.github/workflows/flatpak.yml b/.github/workflows/flatpak.yml
index 084e166..188ffa3 100644
--- a/.github/workflows/flatpak.yml
+++ b/.github/workflows/flatpak.yml
@@ -28,6 +28,9 @@ on:
       - '.github/workflows/flatpak.yml'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true