diff --git a/.github/workflows/automatic-doc-checks.yml b/.github/workflows/automatic-doc-checks.yml
index 5472b1662..d3bba4576 100644
--- a/.github/workflows/automatic-doc-checks.yml
+++ b/.github/workflows/automatic-doc-checks.yml
@@ -3,13 +3,15 @@ name: Core Documentation Checks
 on:
   - workflow_dispatch
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   documentation-checks:
-    uses: canonical/documentation-workflows/.github/workflows/documentation-checks.yaml@main
-    with:
-      working-directory: 'docs/moonray'
-      
+    - uses: canonical/documentation-workflows/.github/workflows/documentation-checks.yaml@main
+      with:
+        working-directory: 'docs/moonray'
diff --git a/.github/workflows/docs-spelling-checks.yml b/.github/workflows/docs-spelling-checks.yml
index d4f4f9da1..913ab75a8 100644
--- a/.github/workflows/docs-spelling-checks.yml
+++ b/.github/workflows/docs-spelling-checks.yml
@@ -5,6 +5,8 @@ on:
   # pull_request:
   #   paths:
   #     - 'docs/**'
+permissions:
+  contents: read
 
 jobs:
   spell-check:
diff --git a/.github/workflows/sync-images.yaml b/.github/workflows/sync-images.yaml
index 02b143a1b..2b3247844 100644
--- a/.github/workflows/sync-images.yaml
+++ b/.github/workflows/sync-images.yaml
@@ -3,6 +3,9 @@ name: Sync upstream images to ghcr.io
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest