diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f5438914..9e295766 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,8 @@ on:
   # Allows running workflow manually
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   POSIX:
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 831b9c86..97cbb1ba 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -13,7 +13,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   CIFuzz:
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 7e829ab9..ca827ead 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -8,7 +8,8 @@ on:
   push:
     branches: [coverity_scan]
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   coverity:
diff --git a/.github/workflows/dragonflybsd.yml b/.github/workflows/dragonflybsd.yml
index 35843209..839f5aff 100644
--- a/.github/workflows/dragonflybsd.yml
+++ b/.github/workflows/dragonflybsd.yml
@@ -9,7 +9,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   DragonflyBSD:
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 4c5c6418..913355f3 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -9,7 +9,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   FreeBSD:
diff --git a/.github/workflows/haiku.yml b/.github/workflows/haiku.yml
index e7abe135..a34c93bd 100644
--- a/.github/workflows/haiku.yml
+++ b/.github/workflows/haiku.yml
@@ -9,7 +9,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   Haiku:
diff --git a/.github/workflows/msvc.yml b/.github/workflows/msvc.yml
index 0cf0cca6..079ca4b5 100644
--- a/.github/workflows/msvc.yml
+++ b/.github/workflows/msvc.yml
@@ -11,7 +11,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   MSVC:
diff --git a/.github/workflows/msys2.yml b/.github/workflows/msys2.yml
index a906b491..39968d1f 100644
--- a/.github/workflows/msys2.yml
+++ b/.github/workflows/msys2.yml
@@ -16,7 +16,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   MSYS2:
diff --git a/.github/workflows/netbsd.yml b/.github/workflows/netbsd.yml
index a32e2a97..79d2868f 100644
--- a/.github/workflows/netbsd.yml
+++ b/.github/workflows/netbsd.yml
@@ -9,7 +9,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   NetBSD:
diff --git a/.github/workflows/openbsd.yml b/.github/workflows/openbsd.yml
index bb2f74a4..ab0637c0 100644
--- a/.github/workflows/openbsd.yml
+++ b/.github/workflows/openbsd.yml
@@ -9,7 +9,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   OpenBSD:
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index 34ce33dd..1bbbae00 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -9,7 +9,8 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   Solaris: