diff --git a/.github/workflows/Dependency Security Scan.yml b/.github/workflows/Dependency Security Scan.yml
index 2018a80..6fff34c 100644
--- a/.github/workflows/Dependency Security Scan.yml	
+++ b/.github/workflows/Dependency Security Scan.yml	
@@ -7,6 +7,8 @@ on:
     paths:
       - 'src/**'
 
+permissions: read-all
+
 jobs:
   scan-actions:
     name: Scan Actions
diff --git a/.github/workflows/Pkg EdFi.Ods.Extensions.TPDM.yml b/.github/workflows/Pkg EdFi.Ods.Extensions.TPDM.yml
index 2542329..5cbd735 100644
--- a/.github/workflows/Pkg EdFi.Ods.Extensions.TPDM.yml	
+++ b/.github/workflows/Pkg EdFi.Ods.Extensions.TPDM.yml	
@@ -30,6 +30,8 @@ on:
         required: false
         description: "Data-Standard-Version: The version of the Data Standard the extention package will work with. Default: 5.1.0"
 
+permissions: read-all
+
 env:
   INFORMATIONAL_VERSION: "7.2"
   BUILD_INCREMENTER: "1"
diff --git a/.github/workflows/publish-nuget-artifact.yml b/.github/workflows/publish-nuget-artifact.yml
index f71a9a4..f334fa5 100644
--- a/.github/workflows/publish-nuget-artifact.yml
+++ b/.github/workflows/publish-nuget-artifact.yml
@@ -2,10 +2,12 @@ name: Publish to Azure Artifacts
 
 on:
   workflow_dispatch:
-  
+
+permissions: read-all
+
 env:
   AZURE_ARTIFACTS_FEED_URL: https://pkgs.dev.azure.com/ed-fi-alliance/Ed-Fi-Alliance-OSS/_packaging/EdFi/nuget/v3/index.json
-  NUGET_AUTH_TOKEN: ${{ secrets.TPDM_AA_PUBLISH }} 
+  NUGET_AUTH_TOKEN: ${{ secrets.TPDM_AA_PUBLISH }}
 
 jobs:
   publish:
@@ -17,13 +19,13 @@ jobs:
         with:
           source-url: ${{ env.AZURE_ARTIFACTS_FEED_URL }}
         env:
-          NUGET_AUTH_TOKEN: ${{ secrets.TPDM_AA_PUBLISH }} 
+          NUGET_AUTH_TOKEN: ${{ secrets.TPDM_AA_PUBLISH }}
 
       - name: Download package
         uses: dawidd6/action-download-artifact@1cf11afe3f1874cee82a8d5a2b45c0fd63f0fa22
         with:
           workflow: Pkg EdFi.Ods.Extensions.TPDM.yml
           path: publish
-      
+
       - name: Publish
         run: dotnet nuget push publish/*/*.nupkg --api-key AzureArtifacts