diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 57c0b440fb..3f83279a0b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -21,6 +21,10 @@ on:
       - '**.tsx'
   schedule:
     - cron: '18 17 * * 1'
+  workflow_dispatch: # Manual
+      
+permissions:
+    contents: read
 
 jobs:
   analyze:
diff --git a/.github/workflows/deploy-fleet-website.yml b/.github/workflows/deploy-fleet-website.yml
index 3b3249b5e9..aeb3df3d5c 100644
--- a/.github/workflows/deploy-fleet-website.yml
+++ b/.github/workflows/deploy-fleet-website.yml
@@ -8,6 +8,9 @@ on:
       - 'docs/**'
       - 'handbook/**'
       
+permissions:
+  contents: read
+
 jobs:
   build:
     if: ${{ github.repository == 'fleetdm/fleet' }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b2b72b6cab..70b10eec15 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -11,6 +11,8 @@ on:
 
 jobs:
   markdown-link-check:
+    permissions: 
+      contents: read # to read files to check dead links 
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml
index 1652548322..53307aeec8 100644
--- a/.github/workflows/fleet-and-orbit.yml
+++ b/.github/workflows/fleet-and-orbit.yml
@@ -17,6 +17,9 @@ on:
       - 'orbit/**.go'
   workflow_dispatch: # Manual
 
+permissions:
+  contents: read
+
 jobs:
   gen:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/fleetctl-preview.yml b/.github/workflows/fleetctl-preview.yml
index 2e874d4bbb..d21062e650 100644
--- a/.github/workflows/fleetctl-preview.yml
+++ b/.github/workflows/fleetctl-preview.yml
@@ -5,6 +5,9 @@ on:
   schedule:
   - cron: '0 2 * * *' # Nightly 2AM UTC
 
+permissions:
+  contents: read
+
 jobs:
   test-preview:
     timeout-minutes: 60
diff --git a/.github/workflows/push-osquery-perf-to-ecr.yml b/.github/workflows/push-osquery-perf-to-ecr.yml
index d741abc8dc..5a8efc8bb3 100644
--- a/.github/workflows/push-osquery-perf-to-ecr.yml
+++ b/.github/workflows/push-osquery-perf-to-ecr.yml
@@ -18,6 +18,9 @@ on:
         required: true
         default: latest
 
+permissions:
+  contents: read
+
 jobs:
   build-docker:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml
index 484580b55a..1dbe29c2e7 100644
--- a/.github/workflows/semgrep-analysis.yml
+++ b/.github/workflows/semgrep-analysis.yml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   semgrep:
     name: Scan
diff --git a/.github/workflows/test-packaging.yml b/.github/workflows/test-packaging.yml
index 4a4c8b1d5d..3417a7824d 100644
--- a/.github/workflows/test-packaging.yml
+++ b/.github/workflows/test-packaging.yml
@@ -9,6 +9,9 @@ on:
     paths:
       - '**.go'
 
+permissions:
+  contents: read
+
 jobs:
   test-packaging:
     strategy:
diff --git a/.github/workflows/test-website.yml b/.github/workflows/test-website.yml
index caab40de75..4441838b53 100644
--- a/.github/workflows/test-website.yml
+++ b/.github/workflows/test-website.yml
@@ -7,6 +7,9 @@ on:
       - 'docs/**'
       - 'handbook/**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 638986e20c..99be763382 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,6 +22,9 @@ on:
 
 name: Run Tests
 
+permissions:
+  contents: read
+
 jobs:
   test-e2e:
     strategy: