diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b85d3bb..97bfcba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,6 +3,9 @@ on: [pull_request]
 jobs:
   preview:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=quantecon_ubuntu2404/disk=large"
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/collab.yml b/.github/workflows/collab.yml
index ae83d44..6a02db6 100644
--- a/.github/workflows/collab.yml
+++ b/.github/workflows/collab.yml
@@ -3,6 +3,9 @@ on: [pull_request]
 jobs:
   execution-checks:
     runs-on: "runs-on=${{ github.run_id }}/family=g4dn.2xlarge/image=ubuntu24-gpu-x64/disk=large"
+    permissions:
+      contents: read
+      pull-requests: write
     container:
       image: docker://us-docker.pkg.dev/colab-images/public/runtime
       options: --gpus all
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a0b33ac..8de8f19 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,9 @@ on:
   push:
     tags:
       - 'publish*'
+permissions:
+  contents: write   # peaceiris/actions-gh-pages pushes the built site to gh-pages
+  actions: read     # dawidd6/action-download-artifact reads the cache.yml build artifact
 jobs:
   publish:
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')