diff --git a/.github/workflows/bundled_gems.yml b/.github/workflows/bundled_gems.yml
index 6c9b0aa..b710b25 100644
--- a/.github/workflows/bundled_gems.yml
+++ b/.github/workflows/bundled_gems.yml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '15 7 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   Update-bundled_gems:
 
diff --git a/.github/workflows/remove-tmp-package.yml b/.github/workflows/remove-tmp-package.yml
index 398005d..26de547 100644
--- a/.github/workflows/remove-tmp-package.yml
+++ b/.github/workflows/remove-tmp-package.yml
@@ -11,6 +11,9 @@ on:
         required: true
         default: 3.0.0-preview1-draft
 
+permissions:
+  contents: read
+
 jobs:
   remove:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test_ruby_versions.yml b/.github/workflows/test_ruby_versions.yml
index 242c667..4c9745d 100644
--- a/.github/workflows/test_ruby_versions.yml
+++ b/.github/workflows/test_ruby_versions.yml
@@ -10,6 +10,9 @@ on:
       - '.github/workflows/ruby_versions.yml'
       - '.github/workflows/test_ruby_versions.yml'
 
+permissions:
+  contents: read
+
 jobs:
   call_defaults:
     uses: ./.github/workflows/ruby_versions.yml
diff --git a/.github/workflows/update_ci_versions.yml b/.github/workflows/update_ci_versions.yml
index 3a97c7a..3cc8bc5 100644
--- a/.github/workflows/update_ci_versions.yml
+++ b/.github/workflows/update_ci_versions.yml
@@ -6,6 +6,9 @@ on:
   repository_dispatch:
     types: "update_ci_versions"
 
+permissions:
+  contents: read
+
 jobs:
   update_ci_versions:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/update_index.yml b/.github/workflows/update_index.yml
index e37413f..b51459f 100644
--- a/.github/workflows/update_index.yml
+++ b/.github/workflows/update_index.yml
@@ -7,6 +7,9 @@ on:
     types: "update_index"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update_index:
     runs-on: ubuntu-latest