diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2967df8..c4a8705 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,6 +10,10 @@ concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  actions: write
+  contents: read
+
 jobs:
   lint:
     name: ktlint
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 189c9dd..10ca194 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -12,6 +12,11 @@ concurrency:
   group: ${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  actions: write
+  contents: read
+  pull-requests: read
+
 jobs:
   lint:
     name: ktlint
diff --git a/.github/workflows/publish-new-version.yml b/.github/workflows/publish-new-version.yml
index 7d14ae6..700fb4b 100644
--- a/.github/workflows/publish-new-version.yml
+++ b/.github/workflows/publish-new-version.yml
@@ -11,6 +11,9 @@ on:
           - minor
           - major
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     uses: GetStream/android-ci-actions/.github/workflows/release-new-version.yml@v0.4