diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 281e2f4ff..4edacb72c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
index 4723c1a8f..cbe9f65e1 100644
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -12,6 +12,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   chromatic-deployment:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-snapshot.yml b/.github/workflows/publish-snapshot.yml
index ae6e4a825..cad39ff0a 100644
--- a/.github/workflows/publish-snapshot.yml
+++ b/.github/workflows/publish-snapshot.yml
@@ -20,6 +20,8 @@ env:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions: {}
+
 jobs:
   publish-snapshot:
     if: github.repository == 'radix-ui/primitives'
diff --git a/.github/workflows/publish-stable.yml b/.github/workflows/publish-stable.yml
index f49efcdd0..ad38475fc 100644
--- a/.github/workflows/publish-stable.yml
+++ b/.github/workflows/publish-stable.yml
@@ -11,6 +11,8 @@ env:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions: {}
+
 jobs:
   publish-stable:
     if: github.repository == 'radix-ui/primitives'