diff --git a/.github/workflows/cron.yaml b/.github/workflows/cron.yaml
index 4bb0a87..8bdbf31 100644
--- a/.github/workflows/cron.yaml
+++ b/.github/workflows/cron.yaml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron:  '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: "ubuntu-latest"
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 0fd6d17..bd71499 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -3,6 +3,9 @@ name: Pull actions
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: "ubuntu-latest"
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 10b29a5..f9b707c 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -6,6 +6,9 @@ on:
       - master
       - dev
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: "ubuntu-latest"