diff --git a/.github/workflows/add-to-project.yaml b/.github/workflows/add-to-project.yaml
index 8c81b644..6262610f 100644
--- a/.github/workflows/add-to-project.yaml
+++ b/.github/workflows/add-to-project.yaml
@@ -5,6 +5,8 @@ on:
     types:
       - opened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add PR to Traefik Labs project
diff --git a/.github/workflows/pr-prod-build.yaml b/.github/workflows/pr-prod-build.yaml
index 6fd63598..3be14d47 100644
--- a/.github/workflows/pr-prod-build.yaml
+++ b/.github/workflows/pr-prod-build.yaml
@@ -6,6 +6,9 @@ on:
 env:
   SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: 72  # 3 days
 
+permissions:
+  contents: read
+
 jobs:
   faency:
     name: Production build test
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 47e13c22..bbecd8cd 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -6,6 +6,9 @@ on:
 env:
   SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: 72  # 3 days
 
+permissions:
+  contents: read
+
 jobs:
   faency:
     name: Test, lint and build