diff --git a/.github/workflows/allo-allo.yaml b/.github/workflows/allo-allo.yaml
index ae395ecd1..9ddf62b60 100644
--- a/.github/workflows/allo-allo.yaml
+++ b/.github/workflows/allo-allo.yaml
@@ -11,6 +11,11 @@ on: # yamllint disable-line rule:truthy
             - "opened"
             - "closed"
 
+permissions:
+    contents: "read" # to read the repository
+    issues: "write" # for the shared workflow to comment on and label issues
+    pull-requests: "write" # for the shared workflow to comment on and label pull requests
+
 jobs:
     allo-allo:
         uses: "anolilab/workflows/.github/workflows/allo-allo.yml@2bd348c5c236a10db670232e5b08619ccbaf55b3" # v21.0.5 # main
diff --git a/.github/workflows/cache-clear.yml b/.github/workflows/cache-clear.yml
index 2c9540195..3a45dfe65 100644
--- a/.github/workflows/cache-clear.yml
+++ b/.github/workflows/cache-clear.yml
@@ -5,6 +5,10 @@ on: # yamllint disable-line rule:truthy
         types:
             - "closed"
 
+permissions:
+    actions: "write" # to delete caches for the merged branch
+    contents: "read" # to read the repository
+
 jobs:
     cleanup-branch-cache:
         uses: "anolilab/workflows/.github/workflows/cleanup-branch-cache.yaml@2bd348c5c236a10db670232e5b08619ccbaf55b3" # v21.0.5 # main
diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml
index d3da02e5d..e2ad0a939 100644
--- a/.github/workflows/stale-issues.yml
+++ b/.github/workflows/stale-issues.yml
@@ -4,6 +4,11 @@ on: # yamllint disable-line rule:truthy
     schedule:
         - cron: "0 0 * * *"
 
+permissions:
+    contents: "read" # to read the repository
+    issues: "write" # for the shared workflow to comment on and label issues
+    pull-requests: "write" # for the shared workflow to comment on and label pull requests
+
 jobs:
     stale-issues:
         uses: "anolilab/workflows/.github/workflows/stale-issues.yml@2bd348c5c236a10db670232e5b08619ccbaf55b3" # v21.0.5 # main