diff --git a/.github/workflows/chart-values.yaml b/.github/workflows/chart-values.yaml
index 143a85f..9cb5bdc 100644
--- a/.github/workflows/chart-values.yaml
+++ b/.github/workflows/chart-values.yaml
@@ -3,6 +3,8 @@ name: Validate chart values and schema
 on:
   workflow_call: {}
 
+permissions: read-all
+
 jobs:
   validate:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/gitleaks.yaml b/.github/workflows/gitleaks.yaml
index 3caad76..64c1078 100644
--- a/.github/workflows/gitleaks.yaml
+++ b/.github/workflows/gitleaks.yaml
@@ -3,6 +3,8 @@ name: Gitleaks
 on:
   workflow_call: {}
 
+permissions: read-all
+
 jobs:
   gitleaks:
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/go-coverage.yaml b/.github/workflows/go-coverage.yaml
index 46f9a73..66761fa 100644
--- a/.github/workflows/go-coverage.yaml
+++ b/.github/workflows/go-coverage.yaml
@@ -11,9 +11,16 @@ on:
       token:
         required: true
 
+permissions: read-all
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    permissions:
+      # Needed to comment on the pull request
+      pull-requests: write
+      # Needed to create a comment on the commit
+      contents: write
     steps:
     - name: Clone repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/publish-techdocs.yaml b/.github/workflows/publish-techdocs.yaml
index c875a42..b373c10 100644
--- a/.github/workflows/publish-techdocs.yaml
+++ b/.github/workflows/publish-techdocs.yaml
@@ -17,6 +17,8 @@ on:
       aws_secret_access_key:
         required: true
 
+permissions: read-all
+
 jobs:
   publish:
     if: github.event.repository.visibility == 'public'
diff --git a/.github/workflows/validate-workflows.yaml b/.github/workflows/validate-workflows.yaml
index 0a46383..d21e15f 100644
--- a/.github/workflows/validate-workflows.yaml
+++ b/.github/workflows/validate-workflows.yaml
@@ -6,6 +6,8 @@ on:
       - '.github/workflows/*.yaml'
   workflow_dispatch: {}
 
+permissions: read-all
+
 jobs:
   validate:
     runs-on: ubuntu-24.04