diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 9dd2842..2830e82 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -3,6 +3,9 @@ name: Dependabot
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   dependabot:
     name: Auto Merge
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 1a44162..44d8b3d 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -6,6 +6,11 @@ on:
   pull_request:
     types: [opened, closed, synchronize]
 
+permissions:
+  contents: write
+  pull-requests: write
+  actions: read
+
 jobs:
   CLAssistant:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fcd44c4..3ec78ba 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: write
+
 jobs:
   update_release_draft:
     name: Update Release