diff --git a/.github/workflows/update-cargo-lock.yml b/.github/workflows/update-cargo-lock.yml
index cdaed996bc0f..f70554386dca 100644
--- a/.github/workflows/update-cargo-lock.yml
+++ b/.github/workflows/update-cargo-lock.yml
@@ -12,6 +12,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   update-cargo-lock:
     name: Update Cargo.lock file
diff --git a/.github/workflows/update-yarn-lock.yml b/.github/workflows/update-yarn-lock.yml
index a3b17ecd851e..b4e5b0923257 100644
--- a/.github/workflows/update-yarn-lock.yml
+++ b/.github/workflows/update-yarn-lock.yml
@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   update-yarn-lock:
     name: Update yarn.lock file
diff --git a/.github/workflows/vscode.yml b/.github/workflows/vscode.yml
index 524aea6ffbd3..baf6ce12d4d0 100644
--- a/.github/workflows/vscode.yml
+++ b/.github/workflows/vscode.yml
@@ -2,6 +2,9 @@ name: Publish Relay VS Code Extension
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   vscode-release:
     name: VSCode Extension Release