diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 53f95be15..d21bea1bc 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -4,8 +4,13 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: write # for release creation (svenstaro/upload-release-action)
+
     if: "!github.event.release.prerelease"
     runs-on: ubuntu-latest
 
@@ -52,6 +57,9 @@ jobs:
           file_glob: true
 
   slack:
+    permissions:
+      actions: read # to list jobs for workflow run (technote-space/workflow-conclusion-action)
+
     name: Slack
     needs: build
     runs-on: ubuntu-latest
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 90ed324b9..f97fdfab9 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ develop ]
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
 
   unit-tests:
diff --git a/.github/workflows/trigger-skeletons.yml b/.github/workflows/trigger-skeletons.yml
index bc4f1a0c1..b42b9630a 100644
--- a/.github/workflows/trigger-skeletons.yml
+++ b/.github/workflows/trigger-skeletons.yml
@@ -12,6 +12,9 @@ on:
         required: true
         default: true
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   build:
     runs-on: ubuntu-latest