diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index af4ffb29a4..ec3306f3a5 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -1,5 +1,7 @@
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   check-dependency-availability:
     name: Check fresh compile and assemble of TDS project
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 1f6badd6b2..af9fa3b5e0 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,6 +4,8 @@ on:
       - 'docs/**'
       - 'gradle/**'
 
+permissions: {}
+
 jobs:
   check-doc-build:
     name: TDS Documentation Build Check
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index 49dce14313..24eab37b10 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -1,5 +1,7 @@
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   check-style:
     name: Code Style Check
diff --git a/.github/workflows/tds.yml b/.github/workflows/tds.yml
index 6f01707301..ea0f485e1d 100644
--- a/.github/workflows/tds.yml
+++ b/.github/workflows/tds.yml
@@ -1,5 +1,7 @@
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   tds-tests:
     name: TDS Tests
diff --git a/.github/workflows/update-docker.yml b/.github/workflows/update-docker.yml
index 9bcc930270..26dad57d86 100644
--- a/.github/workflows/update-docker.yml
+++ b/.github/workflows/update-docker.yml
@@ -14,6 +14,8 @@ on:
         description: 'TDS .war URL'
         required: true
 
+permissions: {}
+
 jobs:
   post:
     runs-on: ubuntu-latest