diff --git a/.github/workflows/Scanner_Bdba.yml b/.github/workflows/Scanner_Bdba.yml
index 2351406c9a7..4bef08dfc88 100644
--- a/.github/workflows/Scanner_Bdba.yml
+++ b/.github/workflows/Scanner_Bdba.yml
@@ -1,4 +1,5 @@
 name: Scanner BDBA
+permissions: read-all
 
 on:
   workflow_dispatch:
diff --git a/.github/workflows/Scanner_Coverity.yml b/.github/workflows/Scanner_Coverity.yml
index 50f44da4bf5..a95489e5442 100644
--- a/.github/workflows/Scanner_Coverity.yml
+++ b/.github/workflows/Scanner_Coverity.yml
@@ -1,4 +1,5 @@
 name: Scanner Coverity
+permissions: read-all
 
 on:
   workflow_dispatch:
diff --git a/.github/workflows/Scanner_McAfee.yml b/.github/workflows/Scanner_McAfee.yml
index 3d449ddaccf..30b882bcf47 100644
--- a/.github/workflows/Scanner_McAfee.yml
+++ b/.github/workflows/Scanner_McAfee.yml
@@ -1,4 +1,5 @@
 name: Virus Scan
+permissions: read-all
 
 on:
   workflow_dispatch:
diff --git a/.github/workflows/probot.yml b/.github/workflows/probot.yml
index 290af2a86a7..fc74b74134d 100644
--- a/.github/workflows/probot.yml
+++ b/.github/workflows/probot.yml
@@ -1,4 +1,5 @@
 name: Probot
+permissions: read-all
 
 on:
   pull_request:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ec06b4bada1..92649e06b13 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,4 +1,5 @@
 name: Publish
+permissions: read-all
 
 on:
   push: