diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml
index 344a86e11..28f7569aa 100644
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -48,6 +48,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: '26.0.1+8'
diff --git a/.github/workflows/aur-bin.yml b/.github/workflows/aur-bin.yml
index f6f00a93e..fa9f7f665 100644
--- a/.github/workflows/aur-bin.yml
+++ b/.github/workflows/aur-bin.yml
@@ -9,6 +9,9 @@ on:
         description: 'Source or Release tag'
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
diff --git a/.github/workflows/av-whitelist.yml b/.github/workflows/av-whitelist.yml
index c29b82bdb..351ba9b16 100644
--- a/.github/workflows/av-whitelist.yml
+++ b/.github/workflows/av-whitelist.yml
@@ -34,6 +34,8 @@ on:
         type: boolean
         default: false
 
+permissions: {}
+
 jobs:
   download-file:
     name: Downloads the file into the VM
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6e0345816..4cc357386 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -17,6 +17,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   test:
     name: Compile and Test
diff --git a/.github/workflows/check-jdk-updates.yml b/.github/workflows/check-jdk-updates.yml
index d721bf1ad..d981f63f8 100644
--- a/.github/workflows/check-jdk-updates.yml
+++ b/.github/workflows/check-jdk-updates.yml
@@ -15,6 +15,8 @@ env:
       }
     }
 
+permissions: {}
+
 jobs:
   check-version:
     name: Checkout latest jdk version
diff --git a/.github/workflows/debian.yml b/.github/workflows/debian.yml
index f0d76d6e7..5e056c8da 100644
--- a/.github/workflows/debian.yml
+++ b/.github/workflows/debian.yml
@@ -32,6 +32,9 @@ env:
   OPENJFX_JMODS_AARCH64: 'https://download2.gluonhq.com/openjfx/25.0.3/openjfx-25.0.3_linux-aarch64_bin-jmods.zip'
   OPENJFX_JMODS_AARCH64_HASH: 'e3fd682354346845d2944a2da2b1ff2b6cb9259d92027f2f9c121b9b93c5e42f'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
index 7677d802d..00977ee1c 100644
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -5,6 +5,9 @@ on:
   workflow_dispatch:
 
 
+permissions:
+  contents: read
+
 jobs:
   check-dependencies:
     uses: skymatic/workflows/.github/workflows/run-dependency-check.yml@8356563bf7b8d1c8d693f75ca487e8f57573cec9 # v3.1.0
diff --git a/.github/workflows/dl-stats.yml b/.github/workflows/dl-stats.yml
index 3c9c0b107..8ee1ae7fa 100644
--- a/.github/workflows/dl-stats.yml
+++ b/.github/workflows/dl-stats.yml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0/15 * * * *' # run every 15 min - don't forget to adjust the "interval" in the json sent to the metrics endpoint
 
+permissions:
+  contents: read
+
 jobs:
   report-download-stats:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index 45221d36f..e8b205552 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -13,6 +13,10 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
diff --git a/.github/workflows/error-db.yml b/.github/workflows/error-db.yml
index 7e27c89ed..1b0104ada 100644
--- a/.github/workflows/error-db.yml
+++ b/.github/workflows/error-db.yml
@@ -6,6 +6,9 @@ on:
   discussion_comment:
     types: [created, edited, deleted]
 
+permissions:
+  discussions: read
+
 jobs:
   update-error-db:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/get-version.yml b/.github/workflows/get-version.yml
index 7d519f33c..450ab3fc8 100644
--- a/.github/workflows/get-version.yml
+++ b/.github/workflows/get-version.yml
@@ -28,6 +28,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   determine-version:
     name: 'Determines the version following semver'
diff --git a/.github/workflows/linux-flatpak.yml b/.github/workflows/linux-flatpak.yml
index eb8a17978..8320e2548 100644
--- a/.github/workflows/linux-flatpak.yml
+++ b/.github/workflows/linux-flatpak.yml
@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
diff --git a/.github/workflows/linux-makepkg.yml b/.github/workflows/linux-makepkg.yml
index dfb6ff425..6114be4be 100644
--- a/.github/workflows/linux-makepkg.yml
+++ b/.github/workflows/linux-makepkg.yml
@@ -23,6 +23,9 @@ on:
       - 'dist/linux/common/**'
       - 'dist/linux/resources/**'
 
+permissions:
+  contents: read
+
 jobs:
   get-version:
     uses: ./.github/workflows/get-version.yml
diff --git a/.github/workflows/mac-dmg-x64.yml b/.github/workflows/mac-dmg-x64.yml
index 501a0cece..1197ce46e 100644
--- a/.github/workflows/mac-dmg-x64.yml
+++ b/.github/workflows/mac-dmg-x64.yml
@@ -62,6 +62,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
diff --git a/.github/workflows/mac-dmg.yml b/.github/workflows/mac-dmg.yml
index fce667ae8..66fc7efd6 100644
--- a/.github/workflows/mac-dmg.yml
+++ b/.github/workflows/mac-dmg.yml
@@ -60,6 +60,9 @@ env:
   VERSION_SUFFIX: ${{ inputs.semVerSuffix || ''}}
 
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Cryptomator.app for ${{ matrix.output-suffix }}
diff --git a/.github/workflows/post-publish.yml b/.github/workflows/post-publish.yml
index 019d4dc08..e7d747f39 100644
--- a/.github/workflows/post-publish.yml
+++ b/.github/workflows/post-publish.yml
@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   notify:
     runs-on: ubuntu-latest
@@ -142,4 +144,3 @@ jobs:
           token: ${{ secrets.CRYPTOBOT_WORKFLOW_DISPATCH_TOKEN }}
           repository: cryptomator/docs
           client-payload: '{ "version": "${{ github.event.release.tag_name }}", "release": ${{ toJson(github.event.release.assets) }} }'
-
diff --git a/.github/workflows/pullrequest.yml b/.github/workflows/pullrequest.yml
index ac62a8ed4..86a072331 100644
--- a/.github/workflows/pullrequest.yml
+++ b/.github/workflows/pullrequest.yml
@@ -11,6 +11,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs: 
   test:
     name: Compile and Test
diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml
index bb33c73b6..aa709c2b5 100644
--- a/.github/workflows/release-check.yml
+++ b/.github/workflows/release-check.yml
@@ -14,6 +14,9 @@ env:
   JAVA_DIST: 'temurin'
   JAVA_VERSION: 26
 
+permissions:
+  contents: read
+
 jobs:
   check-preconditions:
     name: Validate commits pushed to release/hotfix branch to fulfill release requirements
diff --git a/.github/workflows/win-exe.yml b/.github/workflows/win-exe.yml
index 9dcbe12cd..16b486c1b 100644
--- a/.github/workflows/win-exe.yml
+++ b/.github/workflows/win-exe.yml
@@ -71,6 +71,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   build-msi:
     name: Build .msi Installer
diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
index e5a994243..12f06c794 100644
--- a/.github/workflows/winget.yml
+++ b/.github/workflows/winget.yml
@@ -7,6 +7,8 @@ on:
         description: 'Release tag'
         required: true
 
+permissions: {}
+
 jobs:
   winget:
     name: Publish winget package