diff --git a/.github/workflows/gradle-pr.yml b/.github/workflows/gradle-pr.yml
index 99e6e816..8e81a665 100644
--- a/.github/workflows/gradle-pr.yml
+++ b/.github/workflows/gradle-pr.yml
@@ -6,6 +6,10 @@ on:
 
 concurrency: pr-gradle-${{ github.event.pull_request.id }}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   check-version:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/maven-pr.yml b/.github/workflows/maven-pr.yml
index ebeff5da..689d4d4a 100644
--- a/.github/workflows/maven-pr.yml
+++ b/.github/workflows/maven-pr.yml
@@ -6,6 +6,10 @@ on:
 
 concurrency: pr-${{ github.event.pull_request.id }}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   check-version:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 481eff16..fa29d33e 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -6,6 +6,10 @@ on:
 
 concurrency: pr-${{ github.event.pull_request.id }}
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   check-labels:
     runs-on: ubuntu-latest