diff --git a/.github/workflows/backend-checks.yml b/.github/workflows/backend-checks.yml
index 71be1ae63dc..9e3d54a09e6 100644
--- a/.github/workflows/backend-checks.yml
+++ b/.github/workflows/backend-checks.yml
@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
   IOS_SIMULATOR_DEVICE: "iPhone 16 Pro (18.5)"
diff --git a/.github/workflows/cron-checks.yml b/.github/workflows/cron-checks.yml
index eb4083cbb11..2d3ab32863d 100644
--- a/.github/workflows/cron-checks.yml
+++ b/.github/workflows/cron-checks.yml
@@ -17,6 +17,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/record-snapshots.yml b/.github/workflows/record-snapshots.yml
index c05f727ab6b..d43d6ea1d54 100644
--- a/.github/workflows/record-snapshots.yml
+++ b/.github/workflows/record-snapshots.yml
@@ -3,6 +3,10 @@ name: Record Snapshots
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   record:
     name: Record
diff --git a/.github/workflows/release-merge.yml b/.github/workflows/release-merge.yml
index 01763637e78..dfad6184675 100644
--- a/.github/workflows/release-merge.yml
+++ b/.github/workflows/release-merge.yml
@@ -3,9 +3,12 @@ name: "Merge release"
 on:
   issue_comment:
     types: [created]
-
   workflow_dispatch:
 
+permissions:
+  contents: read
+  issues: read
+
 jobs:
   merge-release-to-main:
     name: Merge release to main
diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 8cb3bf1c508..8a44c25aea1 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -3,6 +3,9 @@ name: "Publish new release"
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Publish new release
diff --git a/.github/workflows/release-start.yml b/.github/workflows/release-start.yml
index 4bcf2881c36..9797fa18566 100644
--- a/.github/workflows/release-start.yml
+++ b/.github/workflows/release-start.yml
@@ -8,6 +8,9 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   test-release:
     name: Start new release
diff --git a/.github/workflows/sdk-performance-metrics.yml b/.github/workflows/sdk-performance-metrics.yml
index e937e804ada..f923f92e132 100644
--- a/.github/workflows/sdk-performance-metrics.yml
+++ b/.github/workflows/sdk-performance-metrics.yml
@@ -19,6 +19,10 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   performance:
     name: Metrics
diff --git a/.github/workflows/sdk-size-metrics.yml b/.github/workflows/sdk-size-metrics.yml
index 63ee748216a..40850caefa3 100644
--- a/.github/workflows/sdk-size-metrics.yml
+++ b/.github/workflows/sdk-size-metrics.yml
@@ -16,6 +16,10 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   sdk_size:
     name: Metrics
diff --git a/.github/workflows/smoke-checks.yml b/.github/workflows/smoke-checks.yml
index b0b10b51ec1..b6132998d08 100644
--- a/.github/workflows/smoke-checks.yml
+++ b/.github/workflows/smoke-checks.yml
@@ -19,6 +19,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
   IOS_SIMULATOR_DEVICE: "iPhone 17 Pro (26.2)"
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
index 0259101331f..62f3ce3a389 100644
--- a/.github/workflows/sonar.yml
+++ b/.github/workflows/sonar.yml
@@ -9,6 +9,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/testflight.yml b/.github/workflows/testflight.yml
index 6b74efb36a5..e11228290ef 100644
--- a/.github/workflows/testflight.yml
+++ b/.github/workflows/testflight.yml
@@ -22,6 +22,10 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   deploy:
     runs-on: macos-15
diff --git a/.github/workflows/update-copyright.yml b/.github/workflows/update-copyright.yml
index 3492886d73f..b12e201e7ff 100644
--- a/.github/workflows/update-copyright.yml
+++ b/.github/workflows/update-copyright.yml
@@ -10,6 +10,9 @@ on:
 env:
   HOMEBREW_NO_INSTALL_CLEANUP: 1 # Disable cleanup for homebrew, we don't need it on CI
 
+permissions:
+  contents: read
+
 jobs:
   copyright:
     name: Copyright