diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml
index bed017ba1e1..c91b4d66e5a 100644
--- a/.github/workflows/dependabot-merge.yml
+++ b/.github/workflows/dependabot-merge.yml
@@ -4,6 +4,9 @@ on:
   pull_request_target:
     branches: [ master, next ]
 
+permissions:
+  contents: read
+
 jobs:
   merge-me:
     name: Merge me!
diff --git a/.github/workflows/docker-image-check.yml b/.github/workflows/docker-image-check.yml
index 60588dd4d5d..fb377fc789b 100644
--- a/.github/workflows/docker-image-check.yml
+++ b/.github/workflows/docker-image-check.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron:  '30 4 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 2e6655aca44..050425c0676 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -12,6 +12,9 @@ on:
 env:
   CYPRESS_CACHE_FOLDER: cypress/cache
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest