diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index 492a8e9d..50b5a4b4 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -9,6 +9,9 @@ on:
 env:
   PYTHON_VERSION_DEFAULT: "3.10"
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   docs_xml:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test_java.yml b/.github/workflows/test_java.yml
index dfbcc784..a4632001 100644
--- a/.github/workflows/test_java.yml
+++ b/.github/workflows/test_java.yml
@@ -14,6 +14,9 @@ defaults:
   run:
     working-directory: tools
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test_js.yml b/.github/workflows/test_js.yml
index 4502b200..009831c5 100644
--- a/.github/workflows/test_js.yml
+++ b/.github/workflows/test_js.yml
@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/src/test/js
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     timeout-minutes: 30
diff --git a/.github/workflows/test_php.yml b/.github/workflows/test_php.yml
index 498acebf..ce170961 100644
--- a/.github/workflows/test_php.yml
+++ b/.github/workflows/test_php.yml
@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/src/test/php
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     timeout-minutes: 30
diff --git a/.github/workflows/test_proto.yml b/.github/workflows/test_proto.yml
index 0dfe8cae..49c330c2 100644
--- a/.github/workflows/test_proto.yml
+++ b/.github/workflows/test_proto.yml
@@ -16,6 +16,9 @@ defaults:
   run:
     working-directory: tools/src/test/proto
 
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
 jobs:
   test:
     timeout-minutes: 30