diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 291fa5822..be62af3f2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,9 @@ name: Simple test build
 on:
   - push
   - pull_request
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 9ea82a350..0fc981726 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - master
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sanitizers.yml b/.github/workflows/sanitizers.yml
index 76339e19c..dad5c11d7 100644
--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -2,6 +2,9 @@ name: Sanitizers build
 on:
   - push
   - pull_request
+permissions:
+  contents: read
+
 jobs:
   sanitizers:
     strategy:
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 0317559ad..4144371e2 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -2,6 +2,9 @@ name: Static analysis
 on:
   - push
   - pull_request
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-18.04