diff --git a/.github/workflows/e2e-kind-create.yaml b/.github/workflows/e2e-kind-create.yaml
index 301829e37..3b4984868 100644
--- a/.github/workflows/e2e-kind-create.yaml
+++ b/.github/workflows/e2e-kind-create.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e-kind-create:
     runs-on: ubuntu-latest-4-core
diff --git a/.github/workflows/e2e-kind-decommission.yaml b/.github/workflows/e2e-kind-decommission.yaml
index ae5e16162..9ceffa4ed 100644
--- a/.github/workflows/e2e-kind-decommission.yaml
+++ b/.github/workflows/e2e-kind-decommission.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e-kind-decommission:
     runs-on: ubuntu-latest-4-core
diff --git a/.github/workflows/e2e-kind-upgrades.yaml b/.github/workflows/e2e-kind-upgrades.yaml
index b49eaa964..5a1aed64d 100644
--- a/.github/workflows/e2e-kind-upgrades.yaml
+++ b/.github/workflows/e2e-kind-upgrades.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e-kind-upgrades:
     runs-on: ubuntu-latest-4-core
diff --git a/.github/workflows/e2e-kind-upgradessha256.yaml b/.github/workflows/e2e-kind-upgradessha256.yaml
index f05a472d3..9e1a311a6 100644
--- a/.github/workflows/e2e-kind-upgradessha256.yaml
+++ b/.github/workflows/e2e-kind-upgradessha256.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e-kind-upgradessha256:
     runs-on: ubuntu-latest-4-core
diff --git a/.github/workflows/e2e-kind-versionchecker.yaml b/.github/workflows/e2e-kind-versionchecker.yaml
index 9621b95fa..30ac03c59 100644
--- a/.github/workflows/e2e-kind-versionchecker.yaml
+++ b/.github/workflows/e2e-kind-versionchecker.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e-kind-versionchecker:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/nightly-smoketest.yaml b/.github/workflows/nightly-smoketest.yaml
index 6160106f7..dabc9c603 100644
--- a/.github/workflows/nightly-smoketest.yaml
+++ b/.github/workflows/nightly-smoketest.yaml
@@ -25,6 +25,9 @@ on:
   # allows running from the actions tab in GitHub
   workflow_dispatch: ~
 
+permissions:
+  contents: read
+
 jobs:
   smoketest:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/templates.yaml b/.github/workflows/templates.yaml
index 61413b741..230600033 100644
--- a/.github/workflows/templates.yaml
+++ b/.github/workflows/templates.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   templates:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 5113c507e..1f159b918 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -24,6 +24,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     runs-on: ubuntu-latest