diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 950f487..35ebdc2 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -12,6 +12,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/postgres
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -72,6 +75,9 @@ jobs:
   test:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     strategy:
       fail-fast: false # Don't cancel other tests if one fails
       matrix:
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 64c25c1..29930b3 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -21,6 +21,9 @@ env:
   REGISTRY: ghcr.io
   HELM_REGISTRY: oci://ghcr.io/flanksource/charts
 
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
@@ -91,6 +94,9 @@ jobs:
 
   security-scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41c8bb0..15f2dd8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,9 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository_owner }}/postgres
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b270e50..1ddbec0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,6 +14,9 @@ env:
   TEST_USER: testuser
   TEST_PASSWORD: testpass123
 
+permissions:
+  contents: read
+
 jobs:
   test-env-variables:
     runs-on: ubuntu-latest