diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 685638b27..068aeb1e4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,7 @@
 name: build-and-test
+permissions:
+  contents: read
+
 on: [pull_request, push, merge_group]
 
 jobs:
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 367060689..041199f45 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -1,5 +1,8 @@
 name: pre-commit
 
+permissions:
+  contents: read
+
 on: [pull_request, merge_group]
 
 jobs:
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 48677d541..79fc9fea0 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -1,10 +1,18 @@
 name: close-stale-pr
+
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: "30 1 * * *" # Runs every day at 1:30 UTC
 
 jobs:
   stale:
+    permissions:
+      actions: write
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@v10
@@ -15,7 +23,3 @@ jobs:
           close-pr-message: "This pull request was closed because it has been inactive for more than 7 days since being marked as stale. Please feel free to reopen it if you would like to continue."
           exempt-pr-labels: "ready-to-merge"
           stale-pr-label: "stale"
-permissions:
-  actions: write
-  issues: write
-  pull-requests: write