diff --git a/.github/workflows/beta_version_analyze.yml b/.github/workflows/beta_version_analyze.yml
index 9fe69aefc..bfc2d3b20 100644
--- a/.github/workflows/beta_version_analyze.yml
+++ b/.github/workflows/beta_version_analyze.yml
@@ -6,6 +6,9 @@ on:
     - cron: '0 2 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   # Does a sanity check on packages for the next beta version so we are not surprised by any breaking changes.
   analyze_beta_versions:
diff --git a/.github/workflows/distribute_external.yml b/.github/workflows/distribute_external.yml
index 744735b1f..3e969e84d 100644
--- a/.github/workflows/distribute_external.yml
+++ b/.github/workflows/distribute_external.yml
@@ -22,6 +22,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   determine_platforms:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/distribute_internal.yml b/.github/workflows/distribute_internal.yml
index fda1a66bf..f522af2dc 100644
--- a/.github/workflows/distribute_internal.yml
+++ b/.github/workflows/distribute_internal.yml
@@ -25,6 +25,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   determine_platforms:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/legacy_version_analyze.yml b/.github/workflows/legacy_version_analyze.yml
index addcce903..9eb316975 100644
--- a/.github/workflows/legacy_version_analyze.yml
+++ b/.github/workflows/legacy_version_analyze.yml
@@ -17,6 +17,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   # Centralizes every gating decision for this workflow — path filter, draft
   # state, and push-vs-PR semantics. Downstream jobs only need a single
diff --git a/.github/workflows/pana.yml b/.github/workflows/pana.yml
index 939b8ec3a..5b614782f 100644
--- a/.github/workflows/pana.yml
+++ b/.github/workflows/pana.yml
@@ -12,6 +12,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   stream_chat:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr_title.yml b/.github/workflows/pr_title.yml
index 670abd70f..2f129ad0a 100644
--- a/.github/workflows/pr_title.yml
+++ b/.github/workflows/pr_title.yml
@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   conventional_pr_title:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stream_flutter_workflow.yml b/.github/workflows/stream_flutter_workflow.yml
index 83f131753..5877a89f1 100644
--- a/.github/workflows/stream_flutter_workflow.yml
+++ b/.github/workflows/stream_flutter_workflow.yml
@@ -19,6 +19,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   # Centralizes every gating decision for this workflow — path filter,
   # draft state, and push-vs-PR semantics. Downstream jobs only need a
diff --git a/.github/workflows/update_goldens.yml b/.github/workflows/update_goldens.yml
index 122f4f4ef..148397e2d 100644
--- a/.github/workflows/update_goldens.yml
+++ b/.github/workflows/update_goldens.yml
@@ -13,6 +13,9 @@ on:
           - sdk
           - docs
 
+permissions:
+  contents: write
+
 jobs:
   update_sdk_goldens:
     if: inputs.target == 'sdk' || inputs.target == 'both'