diff --git a/.github/workflows/docker-validation-ci.yml b/.github/workflows/docker-validation-ci.yml
index 3eba7c9df57..ce4c16c8bbc 100644
--- a/.github/workflows/docker-validation-ci.yml
+++ b/.github/workflows/docker-validation-ci.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Docker validation
diff --git a/.github/workflows/docker-validation-nightly.yml b/.github/workflows/docker-validation-nightly.yml
index 9cb0ff258df..c4ff2fc3829 100644
--- a/.github/workflows/docker-validation-nightly.yml
+++ b/.github/workflows/docker-validation-nightly.yml
@@ -20,6 +20,9 @@ on:
       - .ci/env
       - .ci/scripts
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Docker validation
diff --git a/.github/workflows/renovate-validation.yml b/.github/workflows/renovate-validation.yml
index 4e0ff7f20cc..a82ae67b1cd 100644
--- a/.github/workflows/renovate-validation.yml
+++ b/.github/workflows/renovate-validation.yml
@@ -14,6 +14,9 @@ on:
       - .github/workflows/renovate-validation.yml
       - .github/renovate.json
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     name: Renovate validation