diff --git a/.github/workflows/build-esp.yml b/.github/workflows/build-esp.yml
index 34325ad..deb7af1 100644
--- a/.github/workflows/build-esp.yml
+++ b/.github/workflows/build-esp.yml
@@ -1,5 +1,8 @@
 name: ESP
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/build-nuttx.yml b/.github/workflows/build-nuttx.yml
index 554cd5f..14a9abb 100644
--- a/.github/workflows/build-nuttx.yml
+++ b/.github/workflows/build-nuttx.yml
@@ -1,5 +1,8 @@
 name: NuttX
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/build-rpi-baremetal.yml b/.github/workflows/build-rpi-baremetal.yml
index eadc725..48c8d04 100644
--- a/.github/workflows/build-rpi-baremetal.yml
+++ b/.github/workflows/build-rpi-baremetal.yml
@@ -1,5 +1,8 @@
 name: Raspberry Pi Baremetal
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/build-rpi-pico-sdk.yml b/.github/workflows/build-rpi-pico-sdk.yml
index 258c65c..6e03868 100644
--- a/.github/workflows/build-rpi-pico-sdk.yml
+++ b/.github/workflows/build-rpi-pico-sdk.yml
@@ -1,5 +1,8 @@
 name: Raspberry Pi Pico SDK
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/build-stm32-elf.yml b/.github/workflows/build-stm32-elf.yml
index 1b616e2..352e891 100644
--- a/.github/workflows/build-stm32-elf.yml
+++ b/.github/workflows/build-stm32-elf.yml
@@ -1,5 +1,8 @@
 name: STM32 ELF
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/build-stm32-macho.yml b/.github/workflows/build-stm32-macho.yml
index 88bd925..4c96c27 100644
--- a/.github/workflows/build-stm32-macho.yml
+++ b/.github/workflows/build-stm32-macho.yml
@@ -1,5 +1,8 @@
 name: STM32 Macho
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/build-zephyr.yml b/.github/workflows/build-zephyr.yml
index 96c83b1..fa03f43 100644
--- a/.github/workflows/build-zephyr.yml
+++ b/.github/workflows/build-zephyr.yml
@@ -1,5 +1,8 @@
 name: Zephyr
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 11ad1ae..ad6468e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,5 +1,8 @@
 name: Lint
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
diff --git a/.github/workflows/update-swift-version.yml b/.github/workflows/update-swift-version.yml
index 72a0fbd..bdfcec4 100644
--- a/.github/workflows/update-swift-version.yml
+++ b/.github/workflows/update-swift-version.yml
@@ -1,5 +1,8 @@
 name: Update Swift Version
 
+permissions:
+  contents: read
+
 on:
   schedule:
     - cron: '0 0 */7 * *'  # Every 7 days at midnight UTC