diff --git a/.github/workflows/auto_tagger.yml b/.github/workflows/auto_tagger.yml
index 52c8f2c..8e1ea44 100644
--- a/.github/workflows/auto_tagger.yml
+++ b/.github/workflows/auto_tagger.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   find_changes:
     name: "Find changed directories that need tagging"
@@ -29,6 +32,9 @@ jobs:
     runs-on: ubuntu-22.04
     needs: find_changes
     if: needs.find_changes.outputs.matrix_empty == 'false'
+    permissions:
+      contents: write
+      pull-requests: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/compare-changes.yml b/.github/workflows/compare-changes.yml
index 3b493ab..4bc7b2b 100644
--- a/.github/workflows/compare-changes.yml
+++ b/.github/workflows/compare-changes.yml
@@ -6,6 +6,9 @@ on:
       - "compare-changes/**/*"
       - "!compare-changes/README.md"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/.github/workflows/find-changes.yml b/.github/workflows/find-changes.yml
index f92f42d..00a65fe 100644
--- a/.github/workflows/find-changes.yml
+++ b/.github/workflows/find-changes.yml
@@ -6,6 +6,9 @@ on:
       - "find-changes/**/*"
       - "!find-changes/README.md"
 
+permissions:
+  contents: read
+
 jobs:
   example:
     name: Example
diff --git a/.github/workflows/test_calculate_incremental_tag.yml b/.github/workflows/test_calculate_incremental_tag.yml
index 6377301..e0a1b63 100644
--- a/.github/workflows/test_calculate_incremental_tag.yml
+++ b/.github/workflows/test_calculate_incremental_tag.yml
@@ -6,6 +6,9 @@ on:
     paths:
       - calculate-incremental-tag/**
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: calculate-incremental-tag
diff --git a/.github/workflows/test_setup_ruby.yml b/.github/workflows/test_setup_ruby.yml
index 17dad98..8d2524d 100644
--- a/.github/workflows/test_setup_ruby.yml
+++ b/.github/workflows/test_setup_ruby.yml
@@ -7,6 +7,9 @@ on:
       - setup-ruby/**
       - _testing/setup-ruby/**
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: setup-ruby ${{ matrix.os }}/${{ matrix.version }}