diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index bb9c16d5..87a54f67 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -9,7 +9,7 @@ on:
     paths-ignore:
     - '.github/workflows/**'
     - '!.github/workflows/docs.yml'
-
+permissions: read-all
 jobs:
   build:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index 4adafd6e..d8305b94 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -1,7 +1,7 @@
 name: style
 
 on: [push, pull_request]
-
+permissions: read-all
 jobs:
   style-check:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 5248cd2d..6ecc362f 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -4,7 +4,7 @@ on: [push, pull_request]
 
 env:
   CFLAGS: -Wall -Werror
-
+permissions: read-all
 jobs:
   test:
     strategy:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 2a00a6fe..5186ae42 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,7 +1,7 @@
 name: windows
 
 on: [push, pull_request]
-
+permissions: read-all
 jobs:
   windows-msvc:
     runs-on: windows-2022