diff --git a/.github/workflows/test_publish.yml b/.github/workflows/test_publish.yml
index 76c1d0c1..bfc2247f 100644
--- a/.github/workflows/test_publish.yml
+++ b/.github/workflows/test_publish.yml
@@ -15,6 +15,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   release_default:
     uses: ./.github/workflows/publish.yml
diff --git a/.github/workflows/test_publish_pure_python.yml b/.github/workflows/test_publish_pure_python.yml
index c45e135f..81823a3b 100644
--- a/.github/workflows/test_publish_pure_python.yml
+++ b/.github/workflows/test_publish_pure_python.yml
@@ -15,6 +15,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   release:
     uses: ./.github/workflows/publish_pure_python.yml
diff --git a/.github/workflows/test_tox.yml b/.github/workflows/test_tox.yml
index 86cdc564..5b63f669 100644
--- a/.github/workflows/test_tox.yml
+++ b/.github/workflows/test_tox.yml
@@ -19,6 +19,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test_pyos:
     uses: ./.github/workflows/tox.yml
diff --git a/.github/workflows/update_tag.yml b/.github/workflows/update_tag.yml
index be4ca6bc..cfa4b3c1 100644
--- a/.github/workflows/update_tag.yml
+++ b/.github/workflows/update_tag.yml
@@ -5,6 +5,8 @@ on:
     tags:
       - "v*"
 
+permissions: {}
+
 jobs:
   update-majorver:
     name: Update Major Version Tag