diff --git a/.github/workflows/full_test.yml b/.github/workflows/full_test.yml
index bd62ad2b4..341923a71 100644
--- a/.github/workflows/full_test.yml
+++ b/.github/workflows/full_test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/notebooks_test.yml b/.github/workflows/notebooks_test.yml
index dd64a1df6..ef39a8eb8 100644
--- a/.github/workflows/notebooks_test.yml
+++ b/.github/workflows/notebooks_test.yml
@@ -8,6 +8,9 @@ on:
     types: [review_requested, ready_for_review]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index fbb4cc526..8ba0c7e0d 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -8,6 +8,9 @@ on:
     types: [published]
   workflow_dispatch:
     
+permissions:
+  contents: read
+
 jobs:
 
   test:
@@ -34,6 +37,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
 
diff --git a/.github/workflows/scheduled_test.yml b/.github/workflows/scheduled_test.yml
index 9af4045e9..2b99db358 100644
--- a/.github/workflows/scheduled_test.yml
+++ b/.github/workflows/scheduled_test.yml
@@ -7,6 +7,9 @@ on:
     # * is a special character in YAML so you have to quote this string
     - cron:  '0 5 */3 * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/test_mikeio_main.yml b/.github/workflows/test_mikeio_main.yml
index 03600008d..c542b081b 100644
--- a/.github/workflows/test_mikeio_main.yml
+++ b/.github/workflows/test_mikeio_main.yml
@@ -8,6 +8,9 @@ on:
     # Run weekly on Mondays at 5:00 AM UTC
     - cron: '0 5 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   test-mikeio-main:
     runs-on: ubuntu-latest