diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 1846891dd..622871d40 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -15,6 +15,9 @@ env:
   # CHC_VERSION: "0.9.0"
   CH_VERSION: "25.3"
 
+permissions:
+  contents: read
+
 jobs:
   nightly:
     if: ${{ startsWith(github.repository, 'ClickHouse/') }}
diff --git a/.github/workflows/run_examples.yml b/.github/workflows/run_examples.yml
index e67a3a473..d4833407a 100644
--- a/.github/workflows/run_examples.yml
+++ b/.github/workflows/run_examples.yml
@@ -22,6 +22,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.number || github.sha }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
 
 jobs:
   run-examples-with-8-jdk-and-latest:
diff --git a/.github/workflows/test_head.yml b/.github/workflows/test_head.yml
index f1129021b..e343d4dc0 100644
--- a/.github/workflows/test_head.yml
+++ b/.github/workflows/test_head.yml
@@ -19,6 +19,9 @@ concurrency:
 env:
   CH_VERSION: "head"
 
+permissions:
+  contents: read
+
 jobs:
   test-java-client:
     runs-on: ubuntu-latest