diff --git a/.github/workflows/makefile-test.yaml b/.github/workflows/makefile-test.yaml
index 8914e68..ea0ac0a 100644
--- a/.github/workflows/makefile-test.yaml
+++ b/.github/workflows/makefile-test.yaml
@@ -5,6 +5,9 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   run-tests:
     if: "!contains(github.event.pull_request.labels.*.name, 'no-test')"
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 6951a74..d2eea45 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -7,6 +7,10 @@ on:
     branches:
       - 'documentation'
 
+permissions:
+  contents: write
+  pages: write
+
 jobs:
   publish:
     runs-on: macos-latest
diff --git a/.github/workflows/summarize-test.yaml b/.github/workflows/summarize-test.yaml
index 23d01e3..cba62ea 100644
--- a/.github/workflows/summarize-test.yaml
+++ b/.github/workflows/summarize-test.yaml
@@ -5,6 +5,9 @@ on:
   push:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   run-tests:
     if: "!contains(github.event.pull_request.labels.*.name, 'no-test')"