diff --git a/.github/workflows/badge.yml b/.github/workflows/badge.yml
index 66a2757..feeeda1 100644
--- a/.github/workflows/badge.yml
+++ b/.github/workflows/badge.yml
@@ -5,6 +5,9 @@ on:
     workflows: ["Build and Test Arduino Firmware"]
     types: [completed]
 
+permissions:
+  contents: read
+
 jobs:
   generate-badges:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/c-cpp.yml b/.github/workflows/c-cpp.yml
index bb45057..9f0d85c 100644
--- a/.github/workflows/c-cpp.yml
+++ b/.github/workflows/c-cpp.yml
@@ -24,6 +24,9 @@ on:
 env:
   PLATFORMIO_VERSION: 6.1.7
 
+permissions:
+  contents: read
+
 jobs:
   version:
     name: Determine Version
@@ -305,6 +308,8 @@ jobs:
         retention-days: 90
 
   create-tag:
+    permissions:
+      contents: write
     name: Create Git Tag
     runs-on: ubuntu-latest
     needs: [version, build-simulation, build-uno-r3, build-uno-r4-minima]
@@ -423,6 +428,8 @@ jobs:
         fi
 
   create-release:
+    permissions:
+      contents: write
     name: Create Release Assets
     runs-on: ubuntu-latest
     needs: [version, build-simulation, build-uno-r3, build-uno-r4-minima, create-tag]
@@ -603,6 +610,8 @@ jobs:
         echo "**Firmware files are available as artifacts above.**" >> $GITHUB_STEP_SUMMARY
 
   publish-package:
+    permissions:
+      contents: write
     name: Publish to GitHub Packages
     runs-on: ubuntu-latest
     needs: [version, build-simulation, build-uno-r3, build-uno-r4-minima, create-tag]