diff --git a/.github/workflows/get-go-version.yaml b/.github/workflows/get-go-version.yaml
index fa4fb5e00..d77ed0af1 100644
--- a/.github/workflows/get-go-version.yaml
+++ b/.github/workflows/get-go-version.yaml
@@ -10,6 +10,9 @@ on:
         description: "The expected Go version"
         value: ${{ jobs.extract.outputs.version }}
 
+permissions:
+  contents: read
+
 jobs:
   extract:
       runs-on: ubuntu-latest
diff --git a/.github/workflows/nightly-trivy-scan.yml b/.github/workflows/nightly-trivy-scan.yml
index 09dcdbf4f..0999b1c0f 100644
--- a/.github/workflows/nightly-trivy-scan.yml
+++ b/.github/workflows/nightly-trivy-scan.yml
@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: '0 2 * * *' # run at 2 AM UTC
 
+permissions:
+  contents: read
+
 jobs:
   nightly-scan:
     name: Trivy nightly scan
@@ -15,6 +18,7 @@ jobs:
         # list of images that need scan
         images: [velero, velero-plugin-for-aws, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure]
     permissions:
+      contents: read  # for actions/checkout to fetch code
       security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
 
     steps:
diff --git a/.github/workflows/pr-ci-check.yml b/.github/workflows/pr-ci-check.yml
index fd5948f7b..8f431af63 100644
--- a/.github/workflows/pr-ci-check.yml
+++ b/.github/workflows/pr-ci-check.yml
@@ -1,5 +1,9 @@
 name: Pull Request CI Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml
diff --git a/.github/workflows/pr-codespell.yml b/.github/workflows/pr-codespell.yml
index 97cdb48d4..bd12201ca 100644
--- a/.github/workflows/pr-codespell.yml
+++ b/.github/workflows/pr-codespell.yml
@@ -1,5 +1,9 @@
 name: Pull Request Codespell Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   codespell:
diff --git a/.github/workflows/pr-containers.yml b/.github/workflows/pr-containers.yml
index b615d2b8e..555a68aa1 100644
--- a/.github/workflows/pr-containers.yml
+++ b/.github/workflows/pr-containers.yml
@@ -9,6 +9,9 @@ on:
       - 'Dockerfile'
       - 'Dockerfile-Windows'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/pr-filepath-check.yml b/.github/workflows/pr-filepath-check.yml
index 5ec2cb03b..45954873a 100644
--- a/.github/workflows/pr-filepath-check.yml
+++ b/.github/workflows/pr-filepath-check.yml
@@ -1,5 +1,9 @@
 name: Pull Request File Path Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   filepath-check:
diff --git a/.github/workflows/pr-goreleaser.yml b/.github/workflows/pr-goreleaser.yml
index 0cbec3329..b93d0626c 100644
--- a/.github/workflows/pr-goreleaser.yml
+++ b/.github/workflows/pr-goreleaser.yml
@@ -9,6 +9,9 @@ on:
       - '.goreleaser.yml'
       - 'hack/release-tools/goreleaser.sh'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/pr-linter-check.yml b/.github/workflows/pr-linter-check.yml
index 1a25569f1..57058757f 100644
--- a/.github/workflows/pr-linter-check.yml
+++ b/.github/workflows/pr-linter-check.yml
@@ -6,6 +6,10 @@ on:
       - "site/**"
       - "design/**"
       - "**/*.md"
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml
diff --git a/.github/workflows/push-builder.yml b/.github/workflows/push-builder.yml
index 164d9104a..7dd0a9ab4 100644
--- a/.github/workflows/push-builder.yml
+++ b/.github/workflows/push-builder.yml
@@ -6,6 +6,9 @@ on:
     paths:
     - 'hack/build-image/Dockerfile'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml
index b66a339c8..16ef764b7 100644
--- a/.github/workflows/stale-issues.yml
+++ b/.github/workflows/stale-issues.yml
@@ -3,6 +3,11 @@ on:
   schedule:
     - cron: "30 1 * * *" # Every day at 1:30 UTC
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'velero-io/velero'