diff --git a/.github/workflows/CommitMessage.yml b/.github/workflows/CommitMessage.yml
index 8e8deb891f..b724716c62 100644
--- a/.github/workflows/CommitMessage.yml
+++ b/.github/workflows/CommitMessage.yml
@@ -3,6 +3,12 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+  # pull-requests: write lets the sticky-comment step post and clear the
+  # commit-message feedback comment on the PR.
+  pull-requests: write
+
 jobs:
   gitlint:
     name: Check commit messages
diff --git a/.github/workflows/base-installer-cd.yml b/.github/workflows/base-installer-cd.yml
index 99f88e46bd..f417b68a15 100644
--- a/.github/workflows/base-installer-cd.yml
+++ b/.github/workflows/base-installer-cd.yml
@@ -43,6 +43,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  # contents: write is required to tag the repo and publish the GitHub Release
+  # (softprops/action-gh-release); no other GITHUB_TOKEN write is needed here.
+  contents: write
+
 jobs:
   debug_build_and_test:
     env:
diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml
index dc0e169b66..f68f7bc3cb 100644
--- a/.github/workflows/check-whitespace.yml
+++ b/.github/workflows/check-whitespace.yml
@@ -9,6 +9,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     check-whitespace:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index 24fe0db73f..732544d9c7 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -4,6 +4,9 @@ on:
     pull_request:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     lychee:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/openspec-validate.yml b/.github/workflows/openspec-validate.yml
index 3fb92fb38e..8b777f1bf2 100644
--- a/.github/workflows/openspec-validate.yml
+++ b/.github/workflows/openspec-validate.yml
@@ -6,6 +6,9 @@ on:
       - 'openspec/**'
       - '**/AGENTS.md'
 
+permissions:
+  contents: read
+
 jobs:
   validate-refs:
     runs-on: windows-2022
diff --git a/.github/workflows/stray-docs.yml b/.github/workflows/stray-docs.yml
index f7fdce040c..e190573aaa 100644
--- a/.github/workflows/stray-docs.yml
+++ b/.github/workflows/stray-docs.yml
@@ -8,6 +8,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     stray-docs:
         runs-on: ubuntu-latest