diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
index 522078961..f8146e3ef 100644
--- a/.github/workflows/beta.yml
+++ b/.github/workflows/beta.yml
@@ -1,5 +1,8 @@
 name: Beta Branch CI
 
+# Declare default permissions as read only.
+permissions: read-all
+
 on:
   push:
     branches: [beta]
diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index a65be323a..37cad1e58 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -1,4 +1,8 @@
 name: Deploy to GitHub Pages
+
+# Declare default permissions as read only.
+permissions: read-all
+
 on:
   push:
     branches:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5eebd6525..dd8496043 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,5 +1,8 @@
 name: Master Branch CI
 
+# Declare default permissions as read only.
+permissions: read-all
+
 on:
   push:
     branches: [ master ]
diff --git a/.github/workflows/verify-web-demos.yml b/.github/workflows/verify-web-demos.yml
index 111b664c4..be5975ddf 100644
--- a/.github/workflows/verify-web-demos.yml
+++ b/.github/workflows/verify-web-demos.yml
@@ -1,4 +1,8 @@
 name: Verify web demos
+
+# Declare default permissions as read only.
+permissions: read-all
+
 on: [push, pull_request]
 jobs:
   verify-web-demos: