diff --git a/.github/workflows/azurite.yml b/.github/workflows/azurite.yml
index d24325f9..81a9d6d5 100644
--- a/.github/workflows/azurite.yml
+++ b/.github/workflows/azurite.yml
@@ -1,5 +1,5 @@
 name: azurite functional tests
-
+permissions: {}
 on: pull_request
 
 jobs:
diff --git a/.github/workflows/docker-bats.yml b/.github/workflows/docker-bats.yml
index 94aa9ae1..5a3ae3f5 100644
--- a/.github/workflows/docker-bats.yml
+++ b/.github/workflows/docker-bats.yml
@@ -1,5 +1,5 @@
 name: docker bats tests
-
+permissions: {}
 on: pull_request
 
 jobs:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a2be9b8d..b2ce8b7c 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,5 +1,4 @@
 name: Publish Docker image
-
 on:
   release:
     types: [published]
diff --git a/.github/workflows/functional.yml b/.github/workflows/functional.yml
index 8ef4eff6..0dc98eeb 100644
--- a/.github/workflows/functional.yml
+++ b/.github/workflows/functional.yml
@@ -1,5 +1,5 @@
 name: functional tests
-
+permissions: {}
 on: pull_request
 
 jobs:
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 2a727b87..3f9cbc61 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -1,4 +1,5 @@
 name: general
+permissions: {}
 on: pull_request
 jobs:
 
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 5e4fba5a..928129ae 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -1,16 +1,12 @@
 name: goreleaser
-
+permissions:
+  contents: write
 on:
   push:
     # run only against tags
     tags:
       - '*'
 
-permissions:
-  contents: write
-  # packages: write
-  # issues: write
-
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 01ca427d..937afa2c 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -1,4 +1,5 @@
 name: shellcheck
+permissions: {}
 on: pull_request
 jobs:
 
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 2327cc7f..13bdb2c2 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -1,4 +1,5 @@
 name: staticcheck
+permissions: {}
 on: pull_request
 jobs: 
 
diff --git a/.github/workflows/system.yml b/.github/workflows/system.yml
index 99cec412..89bfdcfe 100644
--- a/.github/workflows/system.yml
+++ b/.github/workflows/system.yml
@@ -1,4 +1,5 @@
 name: system tests
+permissions: {}
 on: pull_request
 jobs:
   build: