diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7775dcbf9..767afe28b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -155,6 +155,8 @@ jobs:
         continue-on-error: true
 
   macOS:
+    permissions:
+      contents: none
     runs-on: macos-10.15
     needs: Fetch-Source
     strategy:
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ccca43d27..da7ca7dd9 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -19,6 +19,9 @@ concurrency:
   group: check-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-18.04
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index df35b1b7f..58c6007d2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -6,8 +6,14 @@ concurrency:
   group: lint-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      statuses: write  # for github/super-linter to mark status of each linter run
     name: Lint
     runs-on: ubuntu-latest
     steps: