diff --git a/.github/workflows/deflake.yml b/.github/workflows/deflake.yml
index 5d94dfc84e4..3b7ca3a2c48 100644
--- a/.github/workflows/deflake.yml
+++ b/.github/workflows/deflake.yml
@@ -23,6 +23,9 @@ concurrency:
   cancel-in-progress: |-
     ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/heads/release/') }}
 
+permissions:
+  contents: 'read'
+
 jobs:
   deflake_e2e_linux:
     name: 'E2E Test (Linux) - ${{ matrix.sandbox }}'
diff --git a/.github/workflows/docs-rebuild.yml b/.github/workflows/docs-rebuild.yml
index a4e2c659733..52f585f1803 100644
--- a/.github/workflows/docs-rebuild.yml
+++ b/.github/workflows/docs-rebuild.yml
@@ -5,6 +5,8 @@ on:
       - 'main'
     paths:
       - 'docs/**'
+permissions: {}
+
 jobs:
   trigger-rebuild:
     if: "github.repository == 'google-gemini/gemini-cli'"
diff --git a/.github/workflows/issue-opened-labeler.yml b/.github/workflows/issue-opened-labeler.yml
index 69a0911954c..2954640bf40 100644
--- a/.github/workflows/issue-opened-labeler.yml
+++ b/.github/workflows/issue-opened-labeler.yml
@@ -5,6 +5,9 @@ on:
     types:
       - 'opened'
 
+permissions:
+  issues: 'write'
+
 jobs:
   label-issue:
     runs-on: 'ubuntu-latest'
@@ -21,6 +24,7 @@ jobs:
         with:
           app-id: '${{ secrets.APP_ID }}'
           private-key: '${{ secrets.PRIVATE_KEY }}'
+          permission-issues: 'write'
 
       - name: 'Add need-triage label'
         uses: 'actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea'
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index cbc5bb4f040..f3911eb6f2b 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '00 18 * * *'
 
+permissions:
+  contents: 'read'
+
 jobs:
   linkChecker:
     if: |-
diff --git a/.github/workflows/tools-python-ci.yml b/.github/workflows/tools-python-ci.yml
index 94c5cc09f3b..fed55f507fa 100644
--- a/.github/workflows/tools-python-ci.yml
+++ b/.github/workflows/tools-python-ci.yml
@@ -18,6 +18,9 @@ defaults:
   run:
     shell: 'bash'
 
+permissions:
+  contents: 'read'
+
 jobs:
   python-tests:
     name: 'Python Tests'
diff --git a/.github/workflows/trigger_e2e.yml b/.github/workflows/trigger_e2e.yml
index 56da2727c58..ff977fd2a7c 100644
--- a/.github/workflows/trigger_e2e.yml
+++ b/.github/workflows/trigger_e2e.yml
@@ -13,6 +13,9 @@ on:
         type: 'string'
   pull_request:
 
+permissions:
+  contents: 'read'
+
 jobs:
   save_repo_name:
     if: "github.repository == 'google-gemini/gemini-cli'"