diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index f25362c..f6af8c3 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -20,6 +20,8 @@ jobs:
   quality:
     name: Code Quality
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -112,6 +114,8 @@ jobs:
   test-julia:
     name: Julia Tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         julia-version: ['1.9', '1.10', 'nightly']
@@ -151,6 +155,8 @@ jobs:
   test-rust:
     name: Rust Tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -285,6 +291,8 @@ jobs:
     name: SonarCloud Analysis
     runs-on: ubuntu-latest
     needs: [test-julia]
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -316,6 +324,8 @@ jobs:
     name: Integration Tests
     runs-on: ubuntu-latest
     needs: [container-build]
+    permissions:
+      contents: read
     services:
       redis:
         image: redis:alpine
@@ -372,6 +382,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [integration, security, sonarcloud]
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: read
     environment:
       name: production
       url: https://robot-vacuum.example.com
@@ -400,6 +412,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [quality, security, test-julia, test-rust, container-build, integration]
     if: always()
+    permissions: {}
     steps:
       - name: Check job statuses
         id: check