diff --git a/.github/workflows/dotnetcore.yml b/.github/workflows/dotnetcore.yml
index fb74fe321..1a447a69b 100644
--- a/.github/workflows/dotnetcore.yml
+++ b/.github/workflows/dotnetcore.yml
@@ -26,10 +26,18 @@ on:
       - '.github/workflows/deploy-website.yml'
       - '.github/dns/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
     timeout-minutes: 60
+    permissions:
+      contents: read
+      # SonarCloud / PR decoration when token is present
+      pull-requests: write
+      checks: write
     env:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     steps:
diff --git a/.github/workflows/pr-path-guard.yml b/.github/workflows/pr-path-guard.yml
index 6fcf3dafc..0ab431024 100644
--- a/.github/workflows/pr-path-guard.yml
+++ b/.github/workflows/pr-path-guard.yml
@@ -7,6 +7,10 @@ on:
       - beta
       - stable
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   guard-nc-paths:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f70d9b72..15b920976 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,9 +11,14 @@ on:
         required: true
         default: 'stable'
 
+permissions:
+  contents: read
+
 jobs:
   resolve-version:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       release_tag: ${{ steps.v.outputs.tag }}
       version: ${{ steps.v.outputs.version }}
diff --git a/.github/workflows/rps-saturation.yml b/.github/workflows/rps-saturation.yml
index 127c54aa9..e24a885db 100644
--- a/.github/workflows/rps-saturation.yml
+++ b/.github/workflows/rps-saturation.yml
@@ -119,9 +119,14 @@ on:
         required: true
         default: '3'
 
+permissions:
+  contents: read
+
 jobs:
   rps:
     # PR → beta/stable: compare-spot; push → beta/stable: compare-editions; dispatch: inputs.mode
+    permissions:
+      contents: read
     env:
       RPS_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.mode || (github.event_name == 'pull_request' && 'compare-spot' || 'compare-editions') }}
       RPS_CONCURRENCY: ${{ github.event_name == 'workflow_dispatch' && inputs.concurrency || '8,16,32,64' }}