diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e17655..f4bef62 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/folio.yml b/.github/workflows/folio.yml
index 0578afd..d8d8c91 100644
--- a/.github/workflows/folio.yml
+++ b/.github/workflows/folio.yml
@@ -32,6 +32,9 @@ on:
         description: step budget override (0 = each job's calibrated budget)
         default: "0"
 
+permissions:
+  contents: read
+
 jobs:
   android:
     timeout-minutes: 90
diff --git a/.github/workflows/replay-ui.yml b/.github/workflows/replay-ui.yml
index 3b8cd60..e98497a 100644
--- a/.github/workflows/replay-ui.yml
+++ b/.github/workflows/replay-ui.yml
@@ -19,6 +19,9 @@ on:
         description: step budget for the dogfood run
         default: "80"
 
+permissions:
+  contents: read
+
 jobs:
   dogfood:
     timeout-minutes: 45