diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d2483e2b10e..bb8f47bdbba 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -51,6 +51,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   GGML_NLOOP: 3
   GGML_N_THREADS: 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1f79a838159..2f4084bb254 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
   CMAKE_ARGS: "-DLLAMA_BUILD_EXAMPLES=OFF -DLLAMA_BUILD_TESTS=OFF -DLLAMA_BUILD_TOOLS=ON -DLLAMA_BUILD_SERVER=ON -DGGML_RPC=ON"
diff --git a/.github/workflows/server-metal.yml b/.github/workflows/server-metal.yml
index 1d707bef44a..b256718db82 100644
--- a/.github/workflows/server-metal.yml
+++ b/.github/workflows/server-metal.yml
@@ -26,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   server-metal:
     runs-on: [self-hosted, macOS, ARM64]
diff --git a/.github/workflows/server-webui.yml b/.github/workflows/server-webui.yml
index 94899c93761..d5c3616ae70 100644
--- a/.github/workflows/server-webui.yml
+++ b/.github/workflows/server-webui.yml
@@ -26,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   webui-check:
     name: WebUI Checks
diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml
index 99d05226ba5..770d36ff87d 100644
--- a/.github/workflows/server.yml
+++ b/.github/workflows/server.yml
@@ -30,6 +30,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   server:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/update-ops-docs.yml b/.github/workflows/update-ops-docs.yml
index 2ab06eb9811..392e0ff344c 100644
--- a/.github/workflows/update-ops-docs.yml
+++ b/.github/workflows/update-ops-docs.yml
@@ -15,7 +15,8 @@ on:
 jobs:
     update-ops-docs:
         runs-on: ubuntu-slim
-
+        permissions:
+          contents: read
         steps:
         - name: Checkout repository
           uses: actions/checkout@v6
diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
index 420a98f903b..cec07080ba4 100644
--- a/.github/workflows/winget.yml
+++ b/.github/workflows/winget.yml
@@ -10,7 +10,8 @@ jobs:
     name: Update Winget Package
     runs-on: ubuntu-latest
     if: github.repository_owner == 'ggml-org'
-
+    permissions:
+      contents: read
     steps:
       - name: Install cargo binstall
         uses: cargo-bins/cargo-binstall@268643a6b5ea099f5718ee5cd3ff7dc89a5eb49b