diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fee0b34cb..58ca87573 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,8 +9,8 @@
 name: CodeQL
 
 permissions:
-  security-events: write    # needed to post results
   contents: read
+  security-events: write    # needed to post results
 
 on:
   push:
diff --git a/.github/workflows/desktop-lint.yml b/.github/workflows/desktop-lint.yml
index 5f31ea59c..93ba79464 100644
--- a/.github/workflows/desktop-lint.yml
+++ b/.github/workflows/desktop-lint.yml
@@ -1,5 +1,8 @@
 name: Code Style (C++) 
 
+permissions:
+  contents: read
+
 on:
   # Push trigger not needed for linting, we do not allow direct pushes to master
   pull_request:
diff --git a/.github/workflows/documentation-build.yml b/.github/workflows/documentation-build.yml
index 4c06f9ab3..419cbfbfb 100644
--- a/.github/workflows/documentation-build.yml
+++ b/.github/workflows/documentation-build.yml
@@ -1,5 +1,8 @@
 name: Generate Docs
 
+permissions:
+  contents: read    # write permission to the destination repo come from 'deploy_key'
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/translations-pull.yml b/.github/workflows/translations-pull.yml
index a3db5f86d..71b0b4c22 100644
--- a/.github/workflows/translations-pull.yml
+++ b/.github/workflows/translations-pull.yml
@@ -1,5 +1,9 @@
 name: Update Translations
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     paths:
diff --git a/.github/workflows/translations-push.yml b/.github/workflows/translations-push.yml
index c4d3f61fb..41a7aef40 100644
--- a/.github/workflows/translations-push.yml
+++ b/.github/workflows/translations-push.yml
@@ -1,5 +1,9 @@
 name: Update Translation Source
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   pull_request:
     paths: