diff --git a/.github/workflows/assurance.yml b/.github/workflows/assurance.yml
index 102fd3a..3c98e43 100644
--- a/.github/workflows/assurance.yml
+++ b/.github/workflows/assurance.yml
@@ -32,8 +32,6 @@ on:
     - cron: "17 4 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: read
 
 concurrency:
   group: assurance-${{ github.ref }}
@@ -45,8 +43,12 @@ env:
   CARGO_TERM_COLOR: always
   TARGET: x86_64-unknown-linux-musl
 
+permissions: {}
+
 jobs:
   musl:
+    permissions:
+      contents: read
     name: build and test the published target
     runs-on: ubuntu-latest
     steps:
@@ -89,6 +91,8 @@ jobs:
           retention-days: 3
 
   regressions:
+    permissions:
+      contents: read
     name: root + Landlock regressions
     needs: musl
     runs-on: ubuntu-latest
@@ -244,6 +248,8 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
   fuzz:
+    permissions:
+      contents: read
     name: fuzz the parsers over untrusted input
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 5abf71b..f083f67 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -30,8 +30,6 @@ on:
     - cron: "23 5 * * 1"
   workflow_dispatch:
 
-permissions:
-  contents: read
 
 concurrency:
   group: audit-${{ github.ref }}
@@ -44,8 +42,12 @@ env:
   # now and then.
   CARGO_AUDIT_VERSION: 0.22.2
 
+permissions: {}
+
 jobs:
   audit:
+    permissions:
+      contents: read
     name: cargo audit
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 955e208..a6cf38c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,6 @@ on:
     branches: [main]
   pull_request:
 
-permissions:
-  contents: read
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -29,8 +27,12 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
 
+permissions: {}
+
 jobs:
   test:
+    permissions:
+      contents: read
     name: lint, test and build (gnu)
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7bc0595..deeeaa6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -27,18 +27,20 @@ on:
         description: Tag or commit SHA to build and publish
         required: true
 
-permissions:
-  contents: read
 
 env:
   TARGET: x86_64-unknown-linux-musl
 
+permissions: {}
+
 jobs:
   # Split from `publish` so that nothing running during the build -- a build
   # script, a proc macro, a compromised crate -- is in the same job as the
   # bucket-write OIDC token. This job cannot mint one: it has no `id-token`
   # permission and no environment.
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     outputs:
       sha256: ${{ steps.artifact.outputs.sha256 }}