diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml
index ee2026c8f..ccf66f453 100644
--- a/.github/workflows/stale-bot.yml
+++ b/.github/workflows/stale-bot.yml
@@ -2,6 +2,12 @@ name: Stale bot
 on:
   schedule:
     - cron: '0 0 * * *'  # Run every day at midnight
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest
@@ -22,4 +28,3 @@ jobs:
           remove-stale-when-updated: true
           exempt-issue-labels: pinned
           exempt-pr-labels: pinned
-
diff --git a/.github/workflows/test-main-matrix.yml b/.github/workflows/test-main-matrix.yml
index a8aca0218..a0ebf6171 100644
--- a/.github/workflows/test-main-matrix.yml
+++ b/.github/workflows/test-main-matrix.yml
@@ -7,6 +7,9 @@ on:
       - 'website/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test_main_matrix:
     name: Tests [Node ${{ matrix.node_version }}]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 32d0fcf46..fddae009c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,6 +10,9 @@ on:
       - 'website/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint