diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 09e1bc01..6eb6764c 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -2,6 +2,8 @@ name: Test Deployment
 on:
   deployment_status:
 
+permissions: read-all
+
 jobs:
   e2eTests:
     if:
diff --git a/.github/workflows/empty-issues-closer.yaml b/.github/workflows/empty-issues-closer.yaml
index a65ea63b..9dc7935b 100644
--- a/.github/workflows/empty-issues-closer.yaml
+++ b/.github/workflows/empty-issues-closer.yaml
@@ -6,6 +6,21 @@ on:
       - opened
       - edited
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: write
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   closeEmptyIssuesAndTemplates:
     if: github.repository == 'anuraghazra/github-readme-stats'
diff --git a/.github/workflows/generate-theme-doc.yml b/.github/workflows/generate-theme-doc.yml
index 18099ae9..5c67e211 100644
--- a/.github/workflows/generate-theme-doc.yml
+++ b/.github/workflows/generate-theme-doc.yml
@@ -6,6 +6,21 @@ on:
     paths:
       - "themes/index.js"
 
+permissions:
+  actions: read
+  checks: read
+  contents: write
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   generateThemeDoc:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
index 03715bfa..3fffa90e 100644
--- a/.github/workflows/label-pr.yml
+++ b/.github/workflows/label-pr.yml
@@ -2,6 +2,21 @@ name: "Pull Request Labeler"
 on:
   - pull_request_target
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   triage:
     if: github.repository == 'anuraghazra/github-readme-stats'
diff --git a/.github/workflows/preview-theme.yml b/.github/workflows/preview-theme.yml
index f29155c8..3b25385a 100644
--- a/.github/workflows/preview-theme.yml
+++ b/.github/workflows/preview-theme.yml
@@ -7,6 +7,21 @@ on:
     paths:
       - "themes/index.js"
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   previewTheme:
     name: Install & Preview
diff --git a/.github/workflows/prs-cache-clean.yml b/.github/workflows/prs-cache-clean.yml
index 8ee4670e..e10dd26c 100644
--- a/.github/workflows/prs-cache-clean.yml
+++ b/.github/workflows/prs-cache-clean.yml
@@ -4,6 +4,21 @@ on:
     types:
       - closed
 
+permissions:
+  actions: write
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale-theme-pr-closer.yaml b/.github/workflows/stale-theme-pr-closer.yaml
index cc963c32..a0d101dc 100644
--- a/.github/workflows/stale-theme-pr-closer.yaml
+++ b/.github/workflows/stale-theme-pr-closer.yaml
@@ -3,6 +3,21 @@ on:
   schedule:
     - cron: "0 0 */7 * *"
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   closeOldThemePrs:
     if: github.repository == 'anuraghazra/github-readme-stats'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b6fe191e..214db7fd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,6 +7,8 @@ on:
     branches:
       - master
 
+permissions: read-all
+
 jobs:
   build:
     name: Perform tests
diff --git a/.github/workflows/top-issues-dashboard.yml b/.github/workflows/top-issues-dashboard.yml
index 11ca141f..37f77a0f 100644
--- a/.github/workflows/top-issues-dashboard.yml
+++ b/.github/workflows/top-issues-dashboard.yml
@@ -4,6 +4,21 @@ on:
     - cron: "0 0 */3 * *"
   workflow_dispatch:
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: write
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   showAndLabelTopIssues:
     if: github.repository == 'anuraghazra/github-readme-stats'
diff --git a/.github/workflows/update-langs.yaml b/.github/workflows/update-langs.yaml
index 1c31950a..545200c6 100644
--- a/.github/workflows/update-langs.yaml
+++ b/.github/workflows/update-langs.yaml
@@ -3,6 +3,21 @@ on:
   schedule:
     - cron: "0 0 */30 * *"
 
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  deployments: read
+  id-token: read
+  issues: read
+  discussions: read
+  packages: read
+  pages: read
+  pull-requests: write
+  repository-projects: read
+  security-events: read
+  statuses: read
+
 jobs:
   updateLanguages:
     if: github.repository == 'anuraghazra/github-readme-stats'