diff --git a/.github/workflows/build-unified.yml b/.github/workflows/build-unified.yml
index 28fa1ed..1c479cd 100644
--- a/.github/workflows/build-unified.yml
+++ b/.github/workflows/build-unified.yml
@@ -23,6 +23,9 @@ on:
 env:
   _AZ_REGISTRY: bitwardenprod.azurecr.io
 
+permissions:
+  contents: read
+
 jobs:
   build-docker:
     name: Build Docker image
diff --git a/.github/workflows/release-digital-ocean.yml b/.github/workflows/release-digital-ocean.yml
index 4a84140..b9f30f4 100644
--- a/.github/workflows/release-digital-ocean.yml
+++ b/.github/workflows/release-digital-ocean.yml
@@ -10,6 +10,9 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build-image:
     name: Build Image
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a21baba..56f097f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,6 +19,9 @@ on:
 env:
   _AZ_REGISTRY: bitwardenprod.azurecr.io
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     name: Setup