diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 8ec094470..af181c775 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -14,6 +14,9 @@ on:
       - 'src/pretix/static/**'
       - 'src/tests/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   spelling:
     name: Spellcheck
diff --git a/.github/workflows/strings.yml b/.github/workflows/strings.yml
index 1995bf33d..5589dad95 100644
--- a/.github/workflows/strings.yml
+++ b/.github/workflows/strings.yml
@@ -12,6 +12,9 @@ on:
       - 'doc/**'
       - 'src/pretix/locale/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   compile:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index a1402bc9b..c5e61aebb 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -12,6 +12,9 @@ on:
       - 'src/pretix/locale/**'
       - 'src/pretix/static/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   isort:
     name: isort
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 63711680d..f4b28abe8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,6 +12,9 @@ on:
       - 'doc/**'
       - 'src/pretix/locale/**'
 
+permissions:
+  contents: read  #  to fetch code (actions/checkout)
+
 jobs:
   test:
     runs-on: ubuntu-22.04