diff --git a/.github/workflows/tests-main.yml b/.github/workflows/tests-main.yml
index ef01bfaaf6..67a89f6306 100644
--- a/.github/workflows/tests-main.yml
+++ b/.github/workflows/tests-main.yml
@@ -24,6 +24,9 @@ env:
   GH_TOKEN_SHOP: ${{ secrets.SHOP_GH_READ_CONTENT_TOKEN }}
   DEFAULT_NODE_VERSION: '26.1.0'
 
+permissions:
+  contents: read
+
 jobs:
   main:
     name: '[Main] Node ${{ matrix.node }} in ${{ matrix.os }}'
diff --git a/.github/workflows/tests-manual.yml b/.github/workflows/tests-manual.yml
index 6f49c0f048..c469f99881 100644
--- a/.github/workflows/tests-manual.yml
+++ b/.github/workflows/tests-manual.yml
@@ -44,6 +44,9 @@ env:
   DEFAULT_NODE_VERSION: '26.1.0'
   DEFAULT_OS: 'ubuntu-latest'
 
+permissions:
+  contents: read
+
 jobs:
   manually-triggered:
     name: '[Manual] Test with Node ${{ inputs.node-version }} in ${{ inputs.os }}'
diff --git a/.github/workflows/tests-pr.yml b/.github/workflows/tests-pr.yml
index f2fac95275..cd92ccd444 100644
--- a/.github/workflows/tests-pr.yml
+++ b/.github/workflows/tests-pr.yml
@@ -18,6 +18,9 @@ env:
   GH_TOKEN_SHOP: ${{ secrets.SHOP_GH_READ_CONTENT_TOKEN }}
   DEFAULT_NODE_VERSION: '26.1.0'
 
+permissions:
+  contents: read
+
 jobs:
   type-check:
     name: 'Type check'