diff --git a/.github/workflows/dco-signoff.yaml b/.github/workflows/dco-signoff.yaml
index c41c6ea..110ee35 100644
--- a/.github/workflows/dco-signoff.yaml
+++ b/.github/workflows/dco-signoff.yaml
@@ -12,6 +12,8 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: KineticCafe/actions-dco@v1
         with:
diff --git a/.github/workflows/python-testing.yaml b/.github/workflows/python-testing.yaml
index f8a6cdd..7eedde4 100644
--- a/.github/workflows/python-testing.yaml
+++ b/.github/workflows/python-testing.yaml
@@ -14,12 +14,13 @@ on:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.9", "3.10", "3.11"]
+    permissions:
+      pull-request: read
 
     steps:
     - uses: actions/checkout@v5
diff --git a/.github/workflows/reuse-compliance.yaml b/.github/workflows/reuse-compliance.yaml
index 95df29b..6508c35 100644
--- a/.github/workflows/reuse-compliance.yaml
+++ b/.github/workflows/reuse-compliance.yaml
@@ -9,6 +9,8 @@ on: [push, pull_request]
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      pull-request: read
     steps:
     - uses: actions/checkout@v5
     - name: REUSE Compliance Check