diff --git a/.github/workflows/android-build-scripts-did.yml b/.github/workflows/android-build-scripts-did.yml
index 8fb74fb..2213cb0 100644
--- a/.github/workflows/android-build-scripts-did.yml
+++ b/.github/workflows/android-build-scripts-did.yml
@@ -1,4 +1,6 @@
 name: android build scripts
+permissions:
+  contents: write
 
 on:
   pull_request:
diff --git a/.github/workflows/ios-build-scripts-did.yml b/.github/workflows/ios-build-scripts-did.yml
index 3d3d7bd..b240561 100644
--- a/.github/workflows/ios-build-scripts-did.yml
+++ b/.github/workflows/ios-build-scripts-did.yml
@@ -12,6 +12,8 @@ on:
         required: true
         default: '16.1'
 
+permissions:
+  contents: write
 jobs:
   build-main-on-macos-sonoma:
     name: ios main on sonoma
diff --git a/.github/workflows/linux-build-scripts.yml b/.github/workflows/linux-build-scripts.yml
index a42e980..893f057 100644
--- a/.github/workflows/linux-build-scripts.yml
+++ b/.github/workflows/linux-build-scripts.yml
@@ -1,4 +1,6 @@
 name: linux build scripts
+permissions:
+  contents: read
 
 on:
   push:
diff --git a/.github/workflows/macos-build-scripts.yml b/.github/workflows/macos-build-scripts.yml
index d76fcfe..9d2e319 100644
--- a/.github/workflows/macos-build-scripts.yml
+++ b/.github/workflows/macos-build-scripts.yml
@@ -1,4 +1,6 @@
 name: macos build scripts
+permissions:
+  contents: read
 
 on:
   push:
diff --git a/.github/workflows/periodic-builds-android.yml b/.github/workflows/periodic-builds-android.yml
index d164696..e3930ae 100644
--- a/.github/workflows/periodic-builds-android.yml
+++ b/.github/workflows/periodic-builds-android.yml
@@ -1,4 +1,6 @@
 name: android nightly builds
+permissions:
+  contents: read
 
 on:
   schedule:
diff --git a/.github/workflows/periodic-builds-apple.yml b/.github/workflows/periodic-builds-apple.yml
index 6b3b19b..abf9c7d 100644
--- a/.github/workflows/periodic-builds-apple.yml
+++ b/.github/workflows/periodic-builds-apple.yml
@@ -1,4 +1,6 @@
 name: apple nightly builds
+permissions:
+  contents: read
 
 on:
   schedule:
diff --git a/.github/workflows/tvos-build-scripts.yml b/.github/workflows/tvos-build-scripts.yml
index eaee3ab..97aec82 100644
--- a/.github/workflows/tvos-build-scripts.yml
+++ b/.github/workflows/tvos-build-scripts.yml
@@ -1,4 +1,6 @@
 name: tvos build scripts
+permissions:
+  contents: read
 
 on:
   push: