diff --git a/.github/workflows/go-video-proto.yml b/.github/workflows/go-video-proto.yml
index 6933e39ca..e34008846 100644
--- a/.github/workflows/go-video-proto.yml
+++ b/.github/workflows/go-video-proto.yml
@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   protoc:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml
index 26723b625..a5a52c2fe 100644
--- a/.github/workflows/on-tag.yml
+++ b/.github/workflows/on-tag.yml
@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   version:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 54616592c..12dcfe815 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,10 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   pull-request-on-release:
     name: Create Release PR
diff --git a/.github/workflows/typescript-video-proto.yml b/.github/workflows/typescript-video-proto.yml
index 2d038ef2e..ee35c18fe 100644
--- a/.github/workflows/typescript-video-proto.yml
+++ b/.github/workflows/typescript-video-proto.yml
@@ -7,6 +7,8 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   protoc:
     runs-on: ubuntu-latest