diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 34bc51fb252d..9c5d9e465b4f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -4,6 +4,9 @@ on:
     branches-ignore:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   cartodb-news:
     runs-on: ubuntu-18.04
diff --git a/.github/workflows/node.yml b/.github/workflows/node.yml
index 08f79fc7d78f..7f252cb66b33 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/node.yml
@@ -2,6 +2,9 @@ name: Node.js Tests
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/orm-check.yml b/.github/workflows/orm-check.yml
index b97b62eb1dad..4c752b9726bb 100644
--- a/.github/workflows/orm-check.yml
+++ b/.github/workflows/orm-check.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches-ignore:
       - master
+permissions:
+  contents: read
+
 jobs:
   orm-check:
     runs-on: ubuntu-latest