diff --git a/.github/workflows/auto-assignment.yaml b/.github/workflows/auto-assignment.yaml
index ca62308e89..9838b6acd1 100644
--- a/.github/workflows/auto-assignment.yaml
+++ b/.github/workflows/auto-assignment.yaml
@@ -8,12 +8,13 @@ on:
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   welcome:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
       - uses: actions/github-script@v6
diff --git a/.github/workflows/continuous_integration.yml b/.github/workflows/continuous_integration.yml
index dc04a7a216..2cdd5fa7b2 100644
--- a/.github/workflows/continuous_integration.yml
+++ b/.github/workflows/continuous_integration.yml
@@ -2,6 +2,9 @@ name: Continuous integration
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   black:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale-issues-pr.yml b/.github/workflows/stale-issues-pr.yml
index d7aef5ff00..682e09b682 100644
--- a/.github/workflows/stale-issues-pr.yml
+++ b/.github/workflows/stale-issues-pr.yml
@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: "30 1 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   close-issues:
     runs-on: ubuntu-latest