diff --git a/.github/workflows/aarch64.yml b/.github/workflows/aarch64.yml
index aec37c3860e1..14e7c3d9f564 100644
--- a/.github/workflows/aarch64.yml
+++ b/.github/workflows/aarch64.yml
@@ -2,6 +2,8 @@ name: AArch64 CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 57147238552e..9e576303f479 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -5,6 +5,8 @@ on:
     branches:
       - master
 
+permissions: {}
+
 env:
   TRAVIS_OS_NAME: linux
 
diff --git a/.github/workflows/interpreter.yml b/.github/workflows/interpreter.yml
index 3c74afdd329e..103dc766509b 100644
--- a/.github/workflows/interpreter.yml
+++ b/.github/workflows/interpreter.yml
@@ -2,6 +2,8 @@ name: Interpreter Test
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index ad65fa005259..79c3f143d303 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -2,6 +2,8 @@ name: Linux CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/llvm.yml b/.github/workflows/llvm.yml
index 65d0744575b9..8caebb3c9c95 100644
--- a/.github/workflows/llvm.yml
+++ b/.github/workflows/llvm.yml
@@ -2,6 +2,8 @@ name: LLVM CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d4c93a68aabb..8ae3ac28209e 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -2,6 +2,8 @@ name: macOS CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/openssl.yml b/.github/workflows/openssl.yml
index 7321abddf788..611413e7e678 100644
--- a/.github/workflows/openssl.yml
+++ b/.github/workflows/openssl.yml
@@ -2,6 +2,8 @@ name: OpenSSL CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/regex-engine.yml b/.github/workflows/regex-engine.yml
index e7ee002103b4..26b406b84d3f 100644
--- a/.github/workflows/regex-engine.yml
+++ b/.github/workflows/regex-engine.yml
@@ -2,6 +2,8 @@ name: Regex Engine CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml
index 7ae103e528cf..5a83a26e815a 100644
--- a/.github/workflows/smoke.yml
+++ b/.github/workflows/smoke.yml
@@ -31,6 +31,8 @@ name: Smoke tests
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/wasm32.yml b/.github/workflows/wasm32.yml
index d0012b67c40f..2bb03f6cc5a3 100644
--- a/.github/workflows/wasm32.yml
+++ b/.github/workflows/wasm32.yml
@@ -2,6 +2,8 @@ name: WebAssembly CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/win.yml b/.github/workflows/win.yml
index 9025586fa991..03aac8e2f0b1 100644
--- a/.github/workflows/win.yml
+++ b/.github/workflows/win.yml
@@ -2,6 +2,8 @@ name: Windows CI
 
 on: [push, pull_request]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
diff --git a/.github/workflows/win_build_portable.yml b/.github/workflows/win_build_portable.yml
index 889f4d80c629..a81b9e8083ed 100644
--- a/.github/workflows/win_build_portable.yml
+++ b/.github/workflows/win_build_portable.yml
@@ -10,6 +10,8 @@ on:
         required: true
         type: string
 
+permissions: {}
+
 jobs:
   build:
     runs-on: windows-2022