diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index 82180548c..155c9eda1 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -19,6 +19,8 @@ on:
       - closed
       - labeled
 
+permissions: {}
+
 jobs:
   backport:
     uses: dapr/.github/.github/workflows/backport.yaml@main
diff --git a/.github/workflows/build-tag.yaml b/.github/workflows/build-tag.yaml
index a1515e56f..095b7b511 100644
--- a/.github/workflows/build-tag.yaml
+++ b/.github/workflows/build-tag.yaml
@@ -6,6 +6,9 @@ on:
       - v*
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f9d5b6a80..ffa81aa51 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -13,6 +13,9 @@ on:
   workflow_dispatch:
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/dapr-bot-schedule.yml b/.github/workflows/dapr-bot-schedule.yml
index 562a5fa20..595a611a2 100644
--- a/.github/workflows/dapr-bot-schedule.yml
+++ b/.github/workflows/dapr-bot-schedule.yml
@@ -18,6 +18,8 @@ on:
     - cron: '*/10 * * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   automerge:
     uses: dapr/.github/.github/workflows/automerge.yaml@main
diff --git a/.github/workflows/dapr-bot.yml b/.github/workflows/dapr-bot.yml
index 7c3cb2117..aa9f5b27f 100644
--- a/.github/workflows/dapr-bot.yml
+++ b/.github/workflows/dapr-bot.yml
@@ -3,6 +3,8 @@ name: dapr-bot
 on:
   issue_comment: {types: created}
 
+permissions: {}
+
 jobs:
   daprbot:
     name: bot-processor
diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
index 0a6378e3d..8b486960f 100644
--- a/.github/workflows/fossa.yaml
+++ b/.github/workflows/fossa.yaml
@@ -28,6 +28,10 @@ on:
       - release-*
       - feature/*
   workflow_dispatch: {}
+
+permissions:
+  contents: read
+
 jobs:
   fossa-scan:
     if: github.repository_owner == 'dapr' # FOSSA is not intended to run on forks.
diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index a5c06d7bd..ff2ca90e9 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -29,11 +29,12 @@ concurrency:
   group: release-tag-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   tag:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
     - uses: actions/checkout@v7
       with:
diff --git a/.github/workflows/run-tests.yaml b/.github/workflows/run-tests.yaml
index 5861fdb9e..16b4f4b1a 100644
--- a/.github/workflows/run-tests.yaml
+++ b/.github/workflows/run-tests.yaml
@@ -25,6 +25,10 @@ on:
   repository_dispatch:
     types: [validate-examples]
   merge_group:
+
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest