diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml
index e48dd9b6b1..ef3b1f59fb 100644
--- a/.github/workflows/action.yml
+++ b/.github/workflows/action.yml
@@ -21,6 +21,9 @@ on:
       - '**/README.md'
       - '**/README_zh.md'
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/action_tools.yml b/.github/workflows/action_tools.yml
index 64f8299c26..09cf71e26a 100644
--- a/.github/workflows/action_tools.yml
+++ b/.github/workflows/action_tools.yml
@@ -27,6 +27,9 @@ on:
       - '**/*.h'
       - '**/*.cpp'
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/action_utest.yml b/.github/workflows/action_utest.yml
index 1cf4be1220..c84fe004e0 100644
--- a/.github/workflows/action_utest.yml
+++ b/.github/workflows/action_utest.yml
@@ -21,6 +21,9 @@ on:
       - '**/README.md'
       - '**/README_zh.md'
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   test:
     runs-on: ubuntu-latest