diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 303fec0..24f5fc2 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -2,6 +2,8 @@ name: macos
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ${{matrix.config.os}}
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index ea55625..98c3e28 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -2,6 +2,8 @@ name: ubuntu
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   ubuntu:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index c65377b..8ef0d5e 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -2,6 +2,8 @@ name: windows
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ${{matrix.config.os}}