diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b0615be..7b4efc96 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,8 @@ on:
     branches:
       - main
       - "releases/*"
+permissions:
+  contents: read
 
 jobs:
   build-lint-test:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 7e1e30d6..5cb18f63 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -4,6 +4,8 @@ on:
   schedule:
     # (12 AM PST)
     - cron: "00 07 * * *"
+permissions:
+  contents: read
 
 jobs:
   nightly:
diff --git a/.github/workflows/omes.yml b/.github/workflows/omes.yml
index a6b4d579..2e7de3e7 100644
--- a/.github/workflows/omes.yml
+++ b/.github/workflows/omes.yml
@@ -4,6 +4,8 @@ on:
     branches:
       - main
       - "releases/*"
+permissions:
+  contents: read
 
 jobs:
   omes-image-build:
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index bcb42c59..8e931a8a 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -5,6 +5,8 @@ on:
       - main
       - "releases/*"
   workflow_dispatch: {}
+permissions:
+  contents: read
 
 jobs:
   build-bridge-libraries:
diff --git a/.github/workflows/run-bench.yml b/.github/workflows/run-bench.yml
index 6ccb6254..d4a0ac17 100644
--- a/.github/workflows/run-bench.yml
+++ b/.github/workflows/run-bench.yml
@@ -2,6 +2,8 @@ name: Run Bench
 on:
   workflow_call:
   workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   run-bench:
@@ -51,4 +53,4 @@ jobs:
       - run: dotnet run --configuration Release --project tests/Temporalio.SimpleBench/Temporalio.SimpleBench.csproj -- --workflow-count 10000 --max-cached-workflows 10000 --max-concurrent 10000
 
       - run: dotnet run --configuration Release --project tests/Temporalio.SimpleBench/Temporalio.SimpleBench.csproj -- --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000
-      - run: dotnet run --configuration Release --project tests/Temporalio.SimpleBench/Temporalio.SimpleBench.csproj -- --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000
\ No newline at end of file
+      - run: dotnet run --configuration Release --project tests/Temporalio.SimpleBench/Temporalio.SimpleBench.csproj -- --workflow-count 10000 --max-cached-workflows 1000 --max-concurrent 1000