diff --git a/.github/workflows/api-snapshot-refresh.yml b/.github/workflows/api-snapshot-refresh.yml
index bcb06241..81770302 100644
--- a/.github/workflows/api-snapshot-refresh.yml
+++ b/.github/workflows/api-snapshot-refresh.yml
@@ -7,8 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -17,6 +16,10 @@ concurrency:
 jobs:
   refresh:
     name: Refresh *arr OpenAPI snapshots
+    permissions:
+      # Committing the refreshed snapshots and opening the PR.
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
diff --git a/.github/workflows/ci-skip.yml b/.github/workflows/ci-skip.yml
index 8ff52ad0..b17824ee 100644
--- a/.github/workflows/ci-skip.yml
+++ b/.github/workflows/ci-skip.yml
@@ -16,7 +16,7 @@ on:
       - "scripts/marketing/**"
 
 permissions:
-  checks: write
+  contents: read
 
 concurrency:
   group: ci-skip-${{ github.event.pull_request.number || github.ref }}
@@ -25,6 +25,9 @@ concurrency:
 jobs:
   skip-checks:
     name: CI Skip (docs-only)
+    permissions:
+      # Publishing the no-op check runs that satisfy branch protection.
+      checks: write
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/cleanup-actions-cache.yml b/.github/workflows/cleanup-actions-cache.yml
index 4dc3c9e1..df2b7164 100644
--- a/.github/workflows/cleanup-actions-cache.yml
+++ b/.github/workflows/cleanup-actions-cache.yml
@@ -34,8 +34,7 @@ on:
           - "true"
 
 permissions:
-  # gh cache delete requires actions: write.
-  actions: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}
@@ -44,6 +43,9 @@ concurrency:
 jobs:
   cleanup:
     name: Prune stale caches
+    permissions:
+      # gh cache delete requires actions: write.
+      actions: write
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 859c3f26..834597e9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,11 +5,14 @@ on:
     tags: ["v*"]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   release:
     name: Create GitHub Release
+    permissions:
+      # Creating the GitHub Release requires contents: write.
+      contents: write
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/star-history.yml b/.github/workflows/star-history.yml
index 407965da..48169c29 100644
--- a/.github/workflows/star-history.yml
+++ b/.github/workflows/star-history.yml
@@ -18,7 +18,7 @@ on:
         default: false
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}
@@ -32,6 +32,9 @@ jobs:
     # Forks have no `assets` branch, so a dispatched run there would fail on
     # the checkout below.
     if: github.repository == 'av1155/houndarr'
+    permissions:
+      # Force-pushing the rendered chart to the orphan `assets` branch.
+      contents: write
     runs-on: ubuntu-latest
     timeout-minutes: 10