diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml
index ff250367..62941bb0 100644
--- a/.github/workflows/black.yml
+++ b/.github/workflows/black.yml
@@ -1,5 +1,8 @@
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 jobs:
   python-black:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8c664f79..db43c6da 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,8 @@
 on: [ push, pull_request ]
 
+permissions:
+  contents: read
+
 env:
   CFLAGS: -Werror
   UBUNTU_PACKAGES: |
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index cda14052..3720800f 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -3,6 +3,9 @@ on:
     - cron: '0 0 1,15 * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   COVERITY_SCAN_PROJECT_NAME: linuxwacom/xf86-input-wacom
   COVERITY_SCAN_NOTIFICATION_EMAIL: killertofu@gmail.com