diff --git a/.github/workflows/alpine.yml b/.github/workflows/alpine.yml
index 8ed5337..5443e42 100644
--- a/.github/workflows/alpine.yml
+++ b/.github/workflows/alpine.yml
@@ -3,6 +3,9 @@ name: Alpine Linux
 on:
   push:
   pull_request:
+  
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/amalgamate-ubuntu.yml b/.github/workflows/amalgamate-ubuntu.yml
index a94d495..ef0e7c9 100644
--- a/.github/workflows/amalgamate-ubuntu.yml
+++ b/.github/workflows/amalgamate-ubuntu.yml
@@ -2,6 +2,9 @@ name: Amalgamate Ubuntu CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 160422a..12a0ab3 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -1,5 +1,8 @@
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/risc.yml b/.github/workflows/risc.yml
index 2437da8..f339a88 100644
--- a/.github/workflows/risc.yml
+++ b/.github/workflows/risc.yml
@@ -2,6 +2,9 @@ name: Ubuntu RISC-V rvv VLEN=128 (clang 17)
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/s390x.yml b/.github/workflows/s390x.yml
index fde0c25..917b579 100644
--- a/.github/workflows/s390x.yml
+++ b/.github/workflows/s390x.yml
@@ -7,6 +7,9 @@ on:
   pull_request:
     branches:
       - main
+      
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/ubuntu-sanitize.yml b/.github/workflows/ubuntu-sanitize.yml
index e478a71..c66c07a 100644
--- a/.github/workflows/ubuntu-sanitize.yml
+++ b/.github/workflows/ubuntu-sanitize.yml
@@ -2,6 +2,9 @@ name: Ubuntu latest CI Sanitized
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 4ae9bad..0dac1d1 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -2,6 +2,9 @@ name: Ubuntu latest CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ubuntu22-clang.yml b/.github/workflows/ubuntu22-clang.yml
index 1307507..d0b8d94 100644
--- a/.github/workflows/ubuntu22-clang.yml
+++ b/.github/workflows/ubuntu22-clang.yml
@@ -2,6 +2,9 @@ name: Ubuntu 22.04 CI (clang 15)
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/ubuntu22-gcc12.yml b/.github/workflows/ubuntu22-gcc12.yml
index 49ddf94..67d520e 100644
--- a/.github/workflows/ubuntu22-gcc12.yml
+++ b/.github/workflows/ubuntu22-gcc12.yml
@@ -2,6 +2,9 @@ name: Ubuntu 22.04 CI (GCC 12)
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/ubuntu22.yml b/.github/workflows/ubuntu22.yml
index dd00d3b..082d953 100644
--- a/.github/workflows/ubuntu22.yml
+++ b/.github/workflows/ubuntu22.yml
@@ -2,6 +2,9 @@ name: Ubuntu 22.04 CI (GCC 11)
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/ubuntu24-cxx20.yml b/.github/workflows/ubuntu24-cxx20.yml
index 18c770e..7def905 100644
--- a/.github/workflows/ubuntu24-cxx20.yml
+++ b/.github/workflows/ubuntu24-cxx20.yml
@@ -2,6 +2,9 @@ name: Ubuntu 24.04 CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/ubuntu24.yml b/.github/workflows/ubuntu24.yml
index cb382b9..b2de828 100644
--- a/.github/workflows/ubuntu24.yml
+++ b/.github/workflows/ubuntu24.yml
@@ -2,6 +2,9 @@ name: Ubuntu 24.04 CI (GCC 13)
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ubuntu-build:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/vs17-arm-ci.yml b/.github/workflows/vs17-arm-ci.yml
index 6b4bf39..2043c87 100644
--- a/.github/workflows/vs17-arm-ci.yml
+++ b/.github/workflows/vs17-arm-ci.yml
@@ -2,6 +2,9 @@ name: VS17-ARM-CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs17/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs17-ci.yml b/.github/workflows/vs17-ci.yml
index b7ef7cb..d142a82 100644
--- a/.github/workflows/vs17-ci.yml
+++ b/.github/workflows/vs17-ci.yml
@@ -2,6 +2,9 @@ name: VS17-CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs17/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs17-clang-ci.yml b/.github/workflows/vs17-clang-ci.yml
index b7a92ca..e65d129 100644
--- a/.github/workflows/vs17-clang-ci.yml
+++ b/.github/workflows/vs17-clang-ci.yml
@@ -2,6 +2,9 @@ name: VS17-CLANG-CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs17/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs17-cxx20.yml b/.github/workflows/vs17-cxx20.yml
index 3fce65a..0a46203 100644
--- a/.github/workflows/vs17-cxx20.yml
+++ b/.github/workflows/vs17-cxx20.yml
@@ -2,6 +2,9 @@ name: VS17-CI C++20
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs17/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs18-arm-ci.yml b/.github/workflows/vs18-arm-ci.yml
index c7c4ec1..fecc28b 100644
--- a/.github/workflows/vs18-arm-ci.yml
+++ b/.github/workflows/vs18-arm-ci.yml
@@ -2,6 +2,9 @@ name: VS18-ARM-CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs18/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs18-ci.yml b/.github/workflows/vs18-ci.yml
index 6c21344..0255864 100644
--- a/.github/workflows/vs18-ci.yml
+++ b/.github/workflows/vs18-ci.yml
@@ -2,6 +2,9 @@ name: VS18-CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs18/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs18-clang-ci.yml b/.github/workflows/vs18-clang-ci.yml
index 430f5e2..7f09460 100644
--- a/.github/workflows/vs18-clang-ci.yml
+++ b/.github/workflows/vs18-clang-ci.yml
@@ -2,6 +2,9 @@ name: VS18-CLANG-CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs18/${{matrix.arch}}/${{matrix.cfg}}
diff --git a/.github/workflows/vs18-cxx23.yml b/.github/workflows/vs18-cxx23.yml
index 4a66ccc..80b2205 100644
--- a/.github/workflows/vs18-cxx23.yml
+++ b/.github/workflows/vs18-cxx23.yml
@@ -2,6 +2,9 @@ name: VS18-CI C++23
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     name: vs18/${{matrix.arch}}/${{matrix.cfg}}