diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 181a94f2e3..3fd901782c 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -20,6 +20,9 @@ on:
     branches: [ master ]
     types: [opened, reopened, synchronize, labeled]
 
+permissions:
+  contents: read
+
 jobs:
   event_file:
     name: "Event File"
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index dcac225bc7..caf27e9724 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -22,6 +22,8 @@ jobs:
 
   check-javadoc-consistency:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v5.0.0
     - uses: actions/setup-java@de5a937a1dc73fbc1a67d7d1aa4bebc1082f3190 # v5.0.0
diff --git a/.github/workflows/version-increments.yml b/.github/workflows/version-increments.yml
index 7f0450b41a..c4d9915aef 100644
--- a/.github/workflows/version-increments.yml
+++ b/.github/workflows/version-increments.yml
@@ -5,6 +5,9 @@ on:
     workflows: [ 'Pull-Request Checks' ]
     types: [ completed ]
 
+permissions:
+  contents: read
+
 jobs:
   publish-version-check-results:
     uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/publishVersionCheckResults.yml@master