diff --git a/.github/workflows/documentation.yaml b/.github/workflows/documentation.yaml
index 67e72478a..04d2ecc02 100644
--- a/.github/workflows/documentation.yaml
+++ b/.github/workflows/documentation.yaml
@@ -13,6 +13,9 @@ on:
             - 6.x
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     build:
         name: Sphinx build
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 693f3871d..38fc5d7cd 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -13,6 +13,9 @@ on:
             - 6.x
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     php-cs-fixer:
         name: PHP-CS-Fixer
diff --git a/.github/workflows/qa.yaml b/.github/workflows/qa.yaml
index 43338205c..c10ad8def 100644
--- a/.github/workflows/qa.yaml
+++ b/.github/workflows/qa.yaml
@@ -13,6 +13,9 @@ on:
             - 6.x
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     phpstan:
         name: PHPStan
diff --git a/.github/workflows/symfony-lint.yaml b/.github/workflows/symfony-lint.yaml
index 9be5f668f..3f55b4883 100644
--- a/.github/workflows/symfony-lint.yaml
+++ b/.github/workflows/symfony-lint.yaml
@@ -13,6 +13,9 @@ on:
             - 6.x
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     container:
         name: Symfony container
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index e5c7e2c63..16175d6d7 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -13,6 +13,9 @@ on:
             - 6.x
     pull_request:
 
+permissions:
+    contents: read
+
 jobs:
     test:
         name: PHP ${{ matrix.php-version }} + ${{ matrix.dependencies }} + ${{ matrix.variant }}