diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 5f154a92..47c09774 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -2,6 +2,9 @@ name: doc
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     # Use Ubuntu 20.04 because doxygen 1.8.13 from Ubuntu 18.04 is broken.
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 5467cd8f..1d0181ce 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -2,6 +2,9 @@ name: linux
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index e300a22b..24dd5958 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -2,6 +2,9 @@ name: macos
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: macos-10.15
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index c060f8b9..34bd57be 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -2,6 +2,9 @@ name: windows
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{matrix.os}}