diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2a4eb16..f313e86 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: "27 3 * * 1" # Mondays 03:27 UTC
 
+# Least-privilege default; the analyze job elevates to what CodeQL needs.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index 923c116..869e142 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -28,6 +28,10 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+# Least-privilege default; the publish job elevates (contents:read, packages:write).
+permissions:
+  contents: read
+
 concurrency:
   group: release-docker-${{ github.ref }}
   cancel-in-progress: false
diff --git a/.github/workflows/release-nestjs.yml b/.github/workflows/release-nestjs.yml
index cf93a97..43b63ee 100644
--- a/.github/workflows/release-nestjs.yml
+++ b/.github/workflows/release-nestjs.yml
@@ -26,6 +26,10 @@ on:
     tags: ['v*', 'nestjs-v*']
   workflow_dispatch:
 
+# Least-privilege default; the publish job elevates (contents:write, id-token:write).
+permissions:
+  contents: read
+
 concurrency:
   group: release-nestjs-${{ github.ref }}
   cancel-in-progress: false