diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 92befe4e..2bc7749b 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -5,6 +5,11 @@ name: Security audit
 on:
   schedule:
     - cron: "0 0 * * *"
+
+permissions:
+  contents: read
+  issues: write
+
 jobs:
   audit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 45ebaa2b..2a858f40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,9 @@
+name: Basic CI
+
 on: [push, pull_request]
 
-name: Basic CI
+permissions:
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
@@ -15,6 +18,8 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - if: ${{ contains(matrix.os, 'ubuntu') }}
         run: |
           sudo apt-get update -y
@@ -29,6 +34,8 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - if: ${{ contains(matrix.os, 'ubuntu') }}
         run: |
           sudo apt-get update -y
@@ -43,6 +50,8 @@ jobs:
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - if: ${{ contains(matrix.os, 'ubuntu') }}
         run: |
           sudo apt-get update -y
@@ -71,6 +80,8 @@ jobs:
           - { os: windows-latest , features: windows }
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Initialize workflow variables
       id: vars
       shell: bash
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 731bf745..99b99364 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -8,13 +8,13 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   # * style job configuration
   STYLE_FAIL_ON_FAULT: true ## (bool) fail the build if a style job contains a fault (error or warning); may be overridden on a per-job basis
 
-permissions:
-  contents: read # to fetch code (actions/checkout)
-
 # End the current execution if there is a new changeset in the PR.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -26,6 +26,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: rustup component add rustfmt
@@ -46,6 +48,8 @@ jobs:
           - { os: windows-latest }
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@master
         with:
           toolchain: stable