diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc2c6df975..2e90a18c48 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   COMPOSER_ROOT_VERSION: "4.3.x-dev"
diff --git a/.github/workflows/guides.yml b/.github/workflows/guides.yml
index 7ba7956730..07b9270bd4 100644
--- a/.github/workflows/guides.yml
+++ b/.github/workflows/guides.yml
@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
     COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     COVERAGE: '0'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 187e44039c..d2871b3d97 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,12 +14,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   split:
     name: Subtree Split
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - name: Generate App Token
         id: generate_token