diff --git a/.github/workflows/cron-checks.yml b/.github/workflows/cron-checks.yml
index d66bcb6..3d96e69 100644
--- a/.github/workflows/cron-checks.yml
+++ b/.github/workflows/cron-checks.yml
@@ -15,6 +15,9 @@ env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     name: Test LLC
diff --git a/.github/workflows/release-merge.yml b/.github/workflows/release-merge.yml
index 0176363..5ca277f 100644
--- a/.github/workflows/release-merge.yml
+++ b/.github/workflows/release-merge.yml
@@ -6,6 +6,10 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   merge-release-to-main:
     name: Merge release to main
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 79117b3..13636b0 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -3,6 +3,10 @@ name: "Publish new release"
 on:
   workflow_dispatch:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release:
     name: Publish new release
diff --git a/.github/workflows/release-start.yml b/.github/workflows/release-start.yml
index 3dcd173..5876b1b 100644
--- a/.github/workflows/release-start.yml
+++ b/.github/workflows/release-start.yml
@@ -8,6 +8,10 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   test-release:
     name: Start new release
diff --git a/.github/workflows/sdk-size-metrics.yml b/.github/workflows/sdk-size-metrics.yml
index ec7e2d3..67a19f6 100644
--- a/.github/workflows/sdk-size-metrics.yml
+++ b/.github/workflows/sdk-size-metrics.yml
@@ -12,6 +12,11 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
 
+permissions:
+  actions: write
+  contents: read
+  pull-requests: read
+
 jobs:
   sdk_size:
     name: Metrics
diff --git a/.github/workflows/smoke-checks.yml b/.github/workflows/smoke-checks.yml
index 9869b34..842b821 100644
--- a/.github/workflows/smoke-checks.yml
+++ b/.github/workflows/smoke-checks.yml
@@ -24,6 +24,10 @@ env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GITHUB_PR_NUM: ${{ github.event.pull_request.number }}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   guard:
     name: Guard
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 0259101..a801180 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -12,6 +12,10 @@ concurrency:
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+permissions:
+  actions: read
+  contents: read
+
 jobs:
   sonar:
     runs-on: macos-15
diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml
index 473831b..2d34e58 100644
--- a/.github/workflows/testflight.yml
+++ b/.github/workflows/testflight.yml
@@ -22,6 +22,10 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   deploy:
     runs-on: macos-15
diff --git a/.github/workflows/update-copyright.yml b/.github/workflows/update-copyright.yml
index bfa0799..79b81f5 100644
--- a/.github/workflows/update-copyright.yml
+++ b/.github/workflows/update-copyright.yml
@@ -10,6 +10,10 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   copyright:
     name: Copyright