diff --git a/.github/workflows/build-authenticator.yml b/.github/workflows/build-authenticator.yml
index 96dc1ec6e2..452067c44b 100644
--- a/.github/workflows/build-authenticator.yml
+++ b/.github/workflows/build-authenticator.yml
@@ -29,6 +29,10 @@ env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   JAVA_VERSION: 17
 
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   build:
     name: Build Authenticator
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a15126a333..78155df60c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,6 +30,10 @@ env:
   JAVA_VERSION: 17
   GITHUB_ACTION_RUN_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
+permissions:
+  contents: read
+  packages: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/crowdin-pull-authenticator.yml b/.github/workflows/crowdin-pull-authenticator.yml
index 78d56fe7be..0221afec05 100644
--- a/.github/workflows/crowdin-pull-authenticator.yml
+++ b/.github/workflows/crowdin-pull-authenticator.yml
@@ -10,6 +10,9 @@ jobs:
   crowdin-sync:
     name: Autosync
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
     env:
       _CROWDIN_PROJECT_ID: "673718"
     steps:
diff --git a/.github/workflows/crowdin-pull.yml b/.github/workflows/crowdin-pull.yml
index 03839ef0bd..9aec4c130e 100644
--- a/.github/workflows/crowdin-pull.yml
+++ b/.github/workflows/crowdin-pull.yml
@@ -10,6 +10,9 @@ jobs:
   crowdin-sync:
     name: Autosync
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
     env:
       _CROWDIN_PROJECT_ID: "269690"
     steps:
diff --git a/.github/workflows/crowdin-push-authenticator.yml b/.github/workflows/crowdin-push-authenticator.yml
index a999065ead..7191407ac2 100644
--- a/.github/workflows/crowdin-push-authenticator.yml
+++ b/.github/workflows/crowdin-push-authenticator.yml
@@ -13,6 +13,8 @@ jobs:
   crowdin-push:
     name: Crowdin Push
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     env:
       _CROWDIN_PROJECT_ID: "673718"
     steps:
diff --git a/.github/workflows/crowdin-push.yml b/.github/workflows/crowdin-push.yml
index 2ad5118eca..64c1b66640 100644
--- a/.github/workflows/crowdin-push.yml
+++ b/.github/workflows/crowdin-push.yml
@@ -10,6 +10,8 @@ jobs:
   crowdin-push:
     name: Crowdin Push
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     env:
       _CROWDIN_PROJECT_ID: "269690"
     steps:
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
index 3ae6c43027..06f97de343 100644
--- a/.github/workflows/github-release.yml
+++ b/.github/workflows/github-release.yml
@@ -41,7 +41,6 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: write
-      actions: read
 
     steps:
       - name: Check out repository
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index df325f3395..a90074843b 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -15,6 +15,7 @@ jobs:
   check-run:
     name: Check PR run
     uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+    permissions: read-all
 
   sast:
     name: SAST scan