diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e472d873..4861e650 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -146,6 +150,9 @@ jobs:
 
   release:
     runs-on: ubuntu-latest
+    permissions:
+      # required to create GitHub release
+      contents: write
     needs:
       - artifact
       - test
@@ -187,6 +194,11 @@ jobs:
 
   image:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required to push to GHCR
+      packages: write
     needs:
       - artifact
       - test
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2673a9b2..795ffd93 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -19,6 +23,11 @@ on:
 jobs:
   codeql:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required for code scanning
+      security-events: write
     steps:
       -
         name: Checkout
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 0b98a917..8b0c4127 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -18,6 +22,9 @@ env:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      # required to push to gh-pages
+      contents: write
     steps:
       -
         name: Checkout
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 4720a0bc..5f75f7b3 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 1342d9e6..c0900a88 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -4,6 +4,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -19,6 +23,11 @@ on:
 jobs:
   labeler:
     runs-on: ubuntu-latest
+    permissions:
+      # same as global permissions
+      contents: read
+      # required to update labels
+      issues: write
     steps:
       -
         name: Checkout