diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ad559e5..12e810d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,6 +7,8 @@ on:
     branches:
       - master
 
+permissions: {}
+
 concurrency:
   group: lint-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/upload-critical.yml b/.github/workflows/upload-critical.yml
index 2b9fa8c..c18ea23 100644
--- a/.github/workflows/upload-critical.yml
+++ b/.github/workflows/upload-critical.yml
@@ -8,6 +8,8 @@ on:
     paths:
       - critical
 
+permissions: {}
+
 concurrency:
   cancel-in-progress: true
   group: upload-critical
diff --git a/.github/workflows/upload-removed.yml b/.github/workflows/upload-removed.yml
index beb3595..e7ba826 100644
--- a/.github/workflows/upload-removed.yml
+++ b/.github/workflows/upload-removed.yml
@@ -8,6 +8,8 @@ on:
     paths:
       - removed
 
+permissions: {}
+
 concurrency:
   cancel-in-progress: true
   group: upload-removed