diff --git a/.github/workflows/cffconvert.yml b/.github/workflows/cffconvert.yml
index 0cbaf24059390..9c49ed79d026e 100644
--- a/.github/workflows/cffconvert.yml
+++ b/.github/workflows/cffconvert.yml
@@ -5,6 +5,9 @@ on:
     paths:
       - CITATION.cff
 
+permissions:
+  contents: read
+  
 jobs:
   validate:
     name: "validate"
diff --git a/.github/workflows/generate-xcframework-maccatalyst.yml b/.github/workflows/generate-xcframework-maccatalyst.yml
index 25b2b9bb761d9..4106fe3a33187 100644
--- a/.github/workflows/generate-xcframework-maccatalyst.yml
+++ b/.github/workflows/generate-xcframework-maccatalyst.yml
@@ -9,6 +9,9 @@ on:
 env:
   python_version: 3.11
 
+permissions:
+  contents: read
+
 jobs:
   build_macabi_xcf:
     name: build_${{ matrix.variant }}_xcf
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index a8726aaa7497e..5b23fe29b5528 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -5,6 +5,9 @@
 name: "Validate Gradle Wrapper"
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   validation:
     name: "Validation"
diff --git a/.github/workflows/mac.yml b/.github/workflows/mac.yml
index e99f16afe700c..a84d16d88b794 100644
--- a/.github/workflows/mac.yml
+++ b/.github/workflows/mac.yml
@@ -18,6 +18,9 @@ concurrency:
 env:
   python_version: 3.11
 
+permissions:
+  contents: read
+
 jobs:
   ARM64-Xcode16:
     runs-on: macos-15
diff --git a/.github/workflows/publish-gh-pages.yml b/.github/workflows/publish-gh-pages.yml
index 11745ce24f9e5..7ca453a2cc712 100644
--- a/.github/workflows/publish-gh-pages.yml
+++ b/.github/workflows/publish-gh-pages.yml
@@ -6,6 +6,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   placeholder:
     runs-on: ["self-hosted", "1ES.Pool=onnxruntime-github-Ubuntu2204-AMD-CPU"]
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 8ec2cbe5505c1..4b107adf8fd4e 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -14,6 +14,9 @@ env:
   AZCOPY_AUTO_LOGIN_TYPE: MSI
   AZCOPY_MSI_CLIENT_ID: 63b63039-6328-442f-954b-5a64d124e5b4
 
+permissions:
+  contents: read
+
 jobs:
   Windows-CUDA-12:
     if: github.event_name != 'pull_request'