diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba577be..30c1c63 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches:
       - main
+permissions:
+  contents: read
+
 jobs:
   go-linter:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml
index a5f85d7..1bbfc28 100644
--- a/.github/workflows/lint-pr-title.yml
+++ b/.github/workflows/lint-pr-title.yml
@@ -8,6 +8,10 @@ on:
       - reopened
       - synchronize
 
+permissions:
+  pull-requests: read
+  contents: read
+
 jobs:
   main:
     name: conventional-commit
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 636ca19..b7c2163 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,6 +3,10 @@ on:
     branches:
       - main
 name: release-please
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release-please:
     runs-on: ubuntu-latest