diff --git a/.github/workflows/ci-interpreter.yml b/.github/workflows/ci-interpreter.yml
index f7690320ce..6cd994f652 100644
--- a/.github/workflows/ci-interpreter.yml
+++ b/.github/workflows/ci-interpreter.yml
@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   interpreter:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci-spec.yml b/.github/workflows/ci-spec.yml
index 0b27fd7eb8..8ac65df55a 100644
--- a/.github/workflows/ci-spec.yml
+++ b/.github/workflows/ci-spec.yml
@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   ensure-wasm-latest:
     runs-on: ubuntu-latest
@@ -153,6 +156,8 @@ jobs:
 
   publish-spec:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs:
       - ensure-wasm-latest
       - build-core-spec
diff --git a/.github/workflows/ci-spectec.yml b/.github/workflows/ci-spectec.yml
index e01f2bf2d8..b7ea336f0a 100644
--- a/.github/workflows/ci-spectec.yml
+++ b/.github/workflows/ci-spectec.yml
@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   spec-tec:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/w3c-publish.yml b/.github/workflows/w3c-publish.yml
index 730633a3bc..dee2bbe8fd 100644
--- a/.github/workflows/w3c-publish.yml
+++ b/.github/workflows/w3c-publish.yml
@@ -32,6 +32,9 @@ env:
   YARN_ENABLE_IMMUTABLE_INSTALLS: false
   W3C_STATUS: ${{ github.event_name == 'workflow_dispatch' && inputs.w3c-status || 'CRD' }}
 
+permissions:
+  contents: read
+
 jobs:
   publish-to-w3c-TR:
     if: ${{ github.repository == 'WebAssembly/spec' }}