diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ffe7075..813dede 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
   code-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/code-lint.yml b/.github/workflows/code-lint.yml
index 9dbbe59..58783e8 100644
--- a/.github/workflows/code-lint.yml
+++ b/.github/workflows/code-lint.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
   code-lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e32dd29..4b6fe83 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,6 +8,9 @@ on:
         type: string
 env:
   NEW_VERSION: ${{ github.event.inputs.release_tag }}
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9e8ef04..aa3eb4c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
   code-test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/title-lint.yml b/.github/workflows/title-lint.yml
index b81c5ca..9cba2b9 100644
--- a/.github/workflows/title-lint.yml
+++ b/.github/workflows/title-lint.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+
 jobs:
   title-lint:
     runs-on: ubuntu-latest