diff --git a/.github/workflows/prep-release.yml b/.github/workflows/prep-release.yml
index e4107cf991..65bc142878 100644
--- a/.github/workflows/prep-release.yml
+++ b/.github/workflows/prep-release.yml
@@ -23,6 +23,10 @@ on:
         description: "Use PRs with activity since the last stable git tag"
         required: false
         type: boolean
+
+permissions:
+    contents: read
+
 jobs:
   prep_release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml
index 2a68ad9e19..5b97ad2fcb 100644
--- a/.github/workflows/publish-changelog.yml
+++ b/.github/workflows/publish-changelog.yml
@@ -9,6 +9,10 @@ on:
         description: "The branch to target"
         required: false
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   publish_changelog:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index f2e2f20784..6e6e77cba3 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -12,6 +12,9 @@ on:
         description: "Comma separated list of steps to skip"
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   publish_release:
     runs-on: ubuntu-latest