diff --git a/.github/workflows/ci_static-analysis.yaml b/.github/workflows/ci_static-analysis.yaml
index 139c158c..f06333e4 100644
--- a/.github/workflows/ci_static-analysis.yaml
+++ b/.github/workflows/ci_static-analysis.yaml
@@ -3,6 +3,9 @@ name: static analysis
 
 on: ["pull_request", "push"]
 
+permissions:
+  contents: read
+
 jobs:
   not-grep:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index 959983a2..7b536e5e 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "00 15 * * 1-5"
 
+permissions:
+  contents: read
+
 jobs:
   DAILY_CI:
     # Don't run the cron builds on forks
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
index b7605354..a55d58b8 100644
--- a/.github/workflows/repo-sync.yml
+++ b/.github/workflows/repo-sync.yml
@@ -3,6 +3,10 @@ name: Repo Sync
 on:
   workflow_dispatch:     # allows triggering this manually through the Actions UI
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   repo-sync:
     name: Repo Sync