diff --git a/.github/workflows/checkDependencies.yml b/.github/workflows/checkDependencies.yml
index ccc47fef2a3..5a99ba62d75 100644
--- a/.github/workflows/checkDependencies.yml
+++ b/.github/workflows/checkDependencies.yml
@@ -7,6 +7,9 @@ on:
   schedule:
     - cron:  '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   check-dependencies:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/checkDependencies.yml@master
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fde222c38eb..884cbf53ea5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,9 @@ on:
       - 'docs/**'
       - '*.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/mavenBuild.yml@master
diff --git a/.github/workflows/doCleanCode.yml b/.github/workflows/doCleanCode.yml
index 3a0d9ea0d92..11c682bc2a5 100644
--- a/.github/workflows/doCleanCode.yml
+++ b/.github/workflows/doCleanCode.yml
@@ -7,6 +7,9 @@ on:
   schedule:
     - cron:  '0 2 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   clean-code:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/cleanCode.yml@master
diff --git a/.github/workflows/version-increments.yml b/.github/workflows/version-increments.yml
index 7f0450b41ac..c4d9915aefb 100644
--- a/.github/workflows/version-increments.yml
+++ b/.github/workflows/version-increments.yml
@@ -5,6 +5,9 @@ on:
     workflows: [ 'Pull-Request Checks' ]
     types: [ completed ]
 
+permissions:
+  contents: read
+
 jobs:
   publish-version-check-results:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishVersionCheckResults.yml@master