diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index a13ae34b8..0b50ca222 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -13,11 +13,13 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write  # push images to ghcr.io
 
     strategy:
       matrix:
diff --git a/.github/workflows/dependabot-tidy.yml b/.github/workflows/dependabot-tidy.yml
index 88f9da5cb..2316d27e3 100644
--- a/.github/workflows/dependabot-tidy.yml
+++ b/.github/workflows/dependabot-tidy.yml
@@ -14,8 +14,7 @@ on:
       - "authbridge/**/go.sum"
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 # A Dependabot force-push (rebase) landing while a tidy is in flight would
 # otherwise produce two jobs racing to push the same ref; the loser fails
@@ -29,6 +28,9 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: write        # push tidy commit to the Dependabot PR branch
+      pull-requests: write   # close+reopen the PR to re-trigger CI
     env:
       GOWORK: "off"
       GOTOOLCHAIN: local
diff --git a/.github/workflows/self-assign.yml b/.github/workflows/self-assign.yml
index 1b55966a0..ab60fb3eb 100644
--- a/.github/workflows/self-assign.yml
+++ b/.github/workflows/self-assign.yml
@@ -13,10 +13,12 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 jobs:
   self-assign:
+    permissions:
+      contents: read
+      issues: write  # assign the commenter to the issue
     uses: rossoctl/.github/.github/workflows/self-assign-reusable.yml@main
     secrets:
       ISSUE_ASSIGN_TOKEN: ${{ secrets.ISSUE_ASSIGN_TOKEN }}
diff --git a/.github/workflows/spellcheck_action.yml b/.github/workflows/spellcheck_action.yml
index 3bc6c4b16..74458ac0d 100644
--- a/.github/workflows/spellcheck_action.yml
+++ b/.github/workflows/spellcheck_action.yml
@@ -8,6 +8,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     # disable spell check with 'false' value.
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 9d4138903..727e7c304 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -13,9 +13,12 @@ on:
   workflow_dispatch:
 
 permissions:
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   stale:
+    permissions:
+      contents: read
+      issues: write         # close stale issues
+      pull-requests: write  # close stale PRs
     uses: rossoctl/.github/.github/workflows/stale.yaml@main