diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index dccea83f35..5db22cc15d 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -7,6 +7,8 @@ on:
       - opened
       - reopened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add to project
diff --git a/.github/workflows/latest-changes.yml b/.github/workflows/latest-changes.yml
index b9e45ea629..8e3b03c52e 100644
--- a/.github/workflows/latest-changes.yml
+++ b/.github/workflows/latest-changes.yml
@@ -16,6 +16,10 @@ on:
         required: false
         default: 'false'
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   latest-changes:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-redistribute.yml b/.github/workflows/test-redistribute.yml
index ad9df4bf98..ff9f0560a1 100644
--- a/.github/workflows/test-redistribute.yml
+++ b/.github/workflows/test-redistribute.yml
@@ -9,6 +9,9 @@ on:
       - opened
       - synchronize
 
+permissions:
+  contents: read
+
 jobs:
   test-redistribute:
     runs-on: ubuntu-latest