diff --git a/.github/workflows/code-style.yaml b/.github/workflows/code-style.yaml
index 8870122..147467d 100644
--- a/.github/workflows/code-style.yaml
+++ b/.github/workflows/code-style.yaml
@@ -7,6 +7,9 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
diff --git a/.github/workflows/commands.yaml b/.github/workflows/commands.yaml
index a5ffffc..d4d2942 100644
--- a/.github/workflows/commands.yaml
+++ b/.github/workflows/commands.yaml
@@ -11,6 +11,9 @@ on:
   merge_group:
     types: [checks_requested]
 
+permissions:
+  contents: read
+
 jobs:
   generate-httproute:
     name: Run kuadrantctl generate gatewayapi httproute
diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml
index 5f2bb37..d19c58f 100644
--- a/.github/workflows/testing.yaml
+++ b/.github/workflows/testing.yaml
@@ -11,6 +11,9 @@ on:
   pull_request:
     branches: ['*']
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build executable