diff --git a/.github/workflows/aurora-delete.yml b/.github/workflows/aurora-delete.yml
index a2759dda6b..db0ed1a465 100644
--- a/.github/workflows/aurora-delete.yml
+++ b/.github/workflows/aurora-delete.yml
@@ -12,6 +12,9 @@ on:
         type: string
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   delete:
     name: Delete Aurora DB
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index afa797e716..adf9877639 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,6 +22,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index b51c2bb562..d68a0ce229 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -22,6 +22,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 1843f08d6e..e9e9830b2a 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -21,6 +21,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  
 jobs:
 
   conditional:
@@ -99,4 +102,4 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/status-check
         with:
-          jobs: ${{ toJSON(needs) }}
\ No newline at end of file
+          jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/guides.yml b/.github/workflows/guides.yml
index 720398a37e..76c27fe4af 100644
--- a/.github/workflows/guides.yml
+++ b/.github/workflows/guides.yml
@@ -21,6 +21,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
diff --git a/.github/workflows/js-ci.yml b/.github/workflows/js-ci.yml
index f48ae5abf6..64beb1ba5f 100644
--- a/.github/workflows/js-ci.yml
+++ b/.github/workflows/js-ci.yml
@@ -21,6 +21,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   conditional:
     name: Check conditional workflows and jobs
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 92be95950b..1426a7786b 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -3,6 +3,9 @@ on:
   pull_request_target:
     types: closed
 
+permissions:
+  contents: read
+  
 jobs:
   label:
 
diff --git a/.github/workflows/operator-ci.yml b/.github/workflows/operator-ci.yml
index 732b677d3b..29384b7ed0 100644
--- a/.github/workflows/operator-ci.yml
+++ b/.github/workflows/operator-ci.yml
@@ -23,6 +23,9 @@ concurrency:
   group: operator-ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
 
   conditional:
diff --git a/.github/workflows/quarkus-next.yml b/.github/workflows/quarkus-next.yml
index ec235fbf22..8d88bcc210 100644
--- a/.github/workflows/quarkus-next.yml
+++ b/.github/workflows/quarkus-next.yml
@@ -14,6 +14,9 @@ concurrency:
   group: quarkus-next-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  
 jobs:
   update-quarkus-next-branch:
     name: Update quarkus-next branch
diff --git a/.github/workflows/schedule-nightly.yml b/.github/workflows/schedule-nightly.yml
index a3c93a6201..d241508786 100644
--- a/.github/workflows/schedule-nightly.yml
+++ b/.github/workflows/schedule-nightly.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 0 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
 
   setup:
diff --git a/.github/workflows/snyk-analysis.yml b/.github/workflows/snyk-analysis.yml
index 3f882b7a04..721839e868 100644
--- a/.github/workflows/snyk-analysis.yml
+++ b/.github/workflows/snyk-analysis.yml
@@ -10,6 +10,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   analysis:
     name: Analysis of Quarkus and Operator
diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml
index f368b89944..15f2517e73 100644
--- a/.github/workflows/trivy-analysis.yml
+++ b/.github/workflows/trivy-analysis.yml
@@ -7,6 +7,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+  
 jobs:
 
   analysis:
diff --git a/.github/workflows/weblate.yml b/.github/workflows/weblate.yml
index 98c5de4c3f..ba569f04e7 100644
--- a/.github/workflows/weblate.yml
+++ b/.github/workflows/weblate.yml
@@ -22,6 +22,9 @@ concurrency:
   group: weblate-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  
 jobs:
   update-weblate:
     name: Trigger Weblate to pull the latest changes