diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 55edbbefbaa1..7ee7bc0cd471 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -9,6 +9,9 @@ env:
   RUST_BACKTRACE: short
   RUSTUP_MAX_RETRIES: 10
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index af0e03598ecf..6248ffd66d40 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -17,6 +17,9 @@ env:
   RUSTFLAGS: "-D warnings -W unreachable-pub -W bare-trait-objects"
   RUSTUP_MAX_RETRIES: 10
 
+permissions:
+  contents: read
+
 jobs:
   rust:
     if: ${{ github.repository == 'rust-lang/rust-analyzer' || github.event_name == 'workflow_dispatch' }}
diff --git a/.github/workflows/rustc-pull.yml b/.github/workflows/rustc-pull.yml
index be3362b79bbf..391aa7052c1c 100644
--- a/.github/workflows/rustc-pull.yml
+++ b/.github/workflows/rustc-pull.yml
@@ -6,6 +6,9 @@ on:
     # Run at 04:00 UTC every Monday and Thursday
     - cron: '0 4 * * 1,4'
 
+permissions:
+  contents: read
+
 jobs:
   pull:
     if: github.repository == 'rust-lang/rust-analyzer'