diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba410d5c..966040ec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,6 +41,11 @@ on:
       - '.claude/**'
       - '.idea/**'
 
+permissions:
+  actions: write
+  contents: read
+  pull-requests: read
+
 jobs:
   unit:
     uses: ./.github/workflows/run_tests.yml
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 6cbf6bf2..b34c4f67 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -5,6 +5,10 @@ on:
     - cron: '0 3 * * *'
   workflow_dispatch: { }
 
+permissions:
+  actions: write
+  contents: read
+
 jobs:
   integration:
     uses: ./.github/workflows/run_tests.yml
diff --git a/.github/workflows/python-versions.yml b/.github/workflows/python-versions.yml
index 600f5362..fa3a1678 100644
--- a/.github/workflows/python-versions.yml
+++ b/.github/workflows/python-versions.yml
@@ -19,6 +19,10 @@ concurrency:
   group: python-compatibility-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   resolve:
     name: Resolve on Python ${{ matrix.python }}
diff --git a/.github/workflows/run_tests.yml b/.github/workflows/run_tests.yml
index e2ac653b..6fd9c52d 100644
--- a/.github/workflows/run_tests.yml
+++ b/.github/workflows/run_tests.yml
@@ -29,6 +29,9 @@ jobs:
   lint:
     name: Lint (ruff + mypy + validate pyproject.toml)
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6