diff --git a/.github/workflows/clear_old_posts.yml b/.github/workflows/clear_old_posts.yml
index 797de7d..4c04c98 100644
--- a/.github/workflows/clear_old_posts.yml
+++ b/.github/workflows/clear_old_posts.yml
@@ -1,5 +1,8 @@
 name: Prune Posts and Archive
 
+permissions:
+  contents: write
+
 on:
   push:
     branches:
diff --git a/.github/workflows/request_landing.yml b/.github/workflows/request_landing.yml
index ca3cec5..df8f976 100644
--- a/.github/workflows/request_landing.yml
+++ b/.github/workflows/request_landing.yml
@@ -6,6 +6,9 @@ on:
 
 jobs:
   comment:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/trigger_main_site.yml b/.github/workflows/trigger_main_site.yml
index 01a7b8d..cb7194e 100644
--- a/.github/workflows/trigger_main_site.yml
+++ b/.github/workflows/trigger_main_site.yml
@@ -5,6 +5,9 @@ on:
     paths:
       - 'posts/**'
 
+permissions:
+  contents: read
+
 jobs:
   dispatch:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/validate_post.yml b/.github/workflows/validate_post.yml
index d89cd7b..02a4d5d 100644
--- a/.github/workflows/validate_post.yml
+++ b/.github/workflows/validate_post.yml
@@ -1,4 +1,6 @@
 name: Validate Jekyll Posts
+permissions:
+  contents: read
 
 on:
   pull_request: