diff --git a/.github/workflows/addToAPMProject.yml b/.github/workflows/addToAPMProject.yml
index 3cde2a075..1d6132339 100644
--- a/.github/workflows/addToAPMProject.yml
+++ b/.github/workflows/addToAPMProject.yml
@@ -3,6 +3,9 @@ on:
   issues:
     types:
       - opened
+permissions:
+  contents: read
+
 jobs:
   add_to_project:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 950c18329..336e832ed 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -5,6 +5,10 @@ on:
   pull_request_target:
     types: [opened]
 
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   triage:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/snapshoty.yml b/.github/workflows/snapshoty.yml
index ab7e5e1a8..77fc09c71 100644
--- a/.github/workflows/snapshoty.yml
+++ b/.github/workflows/snapshoty.yml
@@ -12,6 +12,9 @@ on:
     - '*.asciidoc'
     - 'docs/**'
 
+permissions:
+  contents: read
+
 jobs:
   upload:
     runs-on: ubuntu-latest