diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 80b20afb..c7edfc00 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -9,6 +9,9 @@ on:
         type: string
   deployment_status:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.inputs.url || github.event.deployment.payload.web_url || github.event.deployment_status.environment_url }}
   cancel-in-progress: true
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 146242b2..e4b859f0 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -8,6 +8,9 @@ on:
       - "src/content/blog/**"
       - ".github/workflows/test.yml"
 
+permissions:
+  contents: read
+
 jobs:
   sync_devto:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index abc61624..cd9d339f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
   cancel-in-progress: ${{ github.event_name != 'push' }}