diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index cd97cccf9f..3bc539635f 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -9,6 +9,9 @@ on:
   pull_request_target:
     types: [ "labeled", "closed" ]
 
+permissions:
+  contents: read
+
 jobs:
   backport:
     name: Backport PR
diff --git a/.github/workflows/check_translations.yaml b/.github/workflows/check_translations.yaml
index 315922717a..7e97eba8fa 100644
--- a/.github/workflows/check_translations.yaml
+++ b/.github/workflows/check_translations.yaml
@@ -11,6 +11,9 @@ on:
 env:
   python_version: 3.9
 
+permissions:
+  contents: read
+
 jobs:
 
   check:
diff --git a/.github/workflows/qc_checks.yaml b/.github/workflows/qc_checks.yaml
index f826de2875..44c406c505 100644
--- a/.github/workflows/qc_checks.yaml
+++ b/.github/workflows/qc_checks.yaml
@@ -22,6 +22,8 @@ env:
   INVENTREE_BACKUP_DIR: ../test_inventree_backup
   INVENTREE_SITE_URL: http://localhost:8000
 
+permissions:
+  contents: read
 jobs:
   paths-filter:
     name: Filter
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44b616f7c8..3634837acd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
   release:
     types: [ published ]
 
+permissions:
+  contents: read
+
 jobs:
 
   stable:
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index 8389c2af2d..6eb3da2d8d 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -9,6 +9,9 @@ env:
   python_version: 3.9
   node_version: 16
 
+permissions:
+  contents: read
+
 jobs:
   build: