diff --git a/.github/workflows/browsers.yml b/.github/workflows/browsers.yml
index ac2b9e634..1123bb2fc 100644
--- a/.github/workflows/browsers.yml
+++ b/.github/workflows/browsers.yml
@@ -2,6 +2,9 @@ name: Browsers
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Browsers
diff --git a/.github/workflows/bundlers.yml b/.github/workflows/bundlers.yml
index 49f437082..34b8b3b1a 100644
--- a/.github/workflows/bundlers.yml
+++ b/.github/workflows/bundlers.yml
@@ -2,6 +2,9 @@ name: Bundlers
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Bundlers
diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml
index 5af0dab0e..30545ca9f 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/node.yml
@@ -2,6 +2,9 @@ name: Node.js
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Node.js