diff --git a/.github/workflows/discovery-catalog.yml b/.github/workflows/discovery-catalog.yml
index 8d13b5f74..83a5781bf 100644
--- a/.github/workflows/discovery-catalog.yml
+++ b/.github/workflows/discovery-catalog.yml
@@ -19,11 +19,13 @@ on:
       - .github/workflows/discovery-catalog.yml
   workflow_dispatch:
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   snapshot:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/package-ci.yml b/.github/workflows/package-ci.yml
index 854aef5b3..8b4013fee 100644
--- a/.github/workflows/package-ci.yml
+++ b/.github/workflows/package-ci.yml
@@ -10,11 +10,13 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   package:
+    permissions:
+      contents: read
     name: Build and smoke-test package
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 814418e91..f76b54dcb 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -9,8 +9,6 @@ on:
     tags:
       - "v*.*.*"
 
-permissions:
-  contents: read
 
 concurrency:
   group: openenv-package-publish
@@ -19,8 +17,12 @@ concurrency:
 env:
   PACKAGE_NAME: openenv
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build release distribution
     runs-on: ubuntu-latest
     outputs:
diff --git a/.github/workflows/publish-testpypi.yml b/.github/workflows/publish-testpypi.yml
index 095147ef0..1b255f8bb 100644
--- a/.github/workflows/publish-testpypi.yml
+++ b/.github/workflows/publish-testpypi.yml
@@ -12,8 +12,6 @@ on:
         required: false
         type: string
 
-permissions:
-  contents: read
 
 concurrency:
   group: openenv-package-publish
@@ -22,8 +20,12 @@ concurrency:
 env:
   PACKAGE_NAME: openenv
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build TestPyPI distribution
     runs-on: ubuntu-latest
     outputs:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fe652ba98..34714a02a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,8 +13,12 @@ on:
 env:
   UV_VERSION: "0.9.3"
 
+permissions: {}
+
 jobs:
   validate-env-locks:
+    permissions:
+      contents: read
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
 
@@ -61,6 +65,8 @@ jobs:
           done
 
   test:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -97,6 +103,8 @@ jobs:
           PYTHONPATH: src:envs
 
   test-thinkingbox-env:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -131,6 +139,8 @@ jobs:
           PYTHONPATH: src:envs
 
   check-env-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -145,6 +155,8 @@ jobs:
         run: python scripts/sync_env_docs.py --check
 
   lint:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/validation-runtime.yml b/.github/workflows/validation-runtime.yml
index d4a9aebb6..403435353 100644
--- a/.github/workflows/validation-runtime.yml
+++ b/.github/workflows/validation-runtime.yml
@@ -6,11 +6,13 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   runtime:
+    permissions:
+      contents: read
     name: Runtime validation / Linux Docker
     runs-on: ubuntu-24.04
     timeout-minutes: 30