diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b8a0ba66..2e8824a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
     types:
     - published
 
+permissions: {}
+
 jobs:
   dist:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 71c79eaf..1dd62034 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,6 +28,8 @@ on:
   workflow_dispatch:
     # allow manual runs on branches without a PR
 
+permissions: {}
+
 concurrency:
   group: test-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 51bb5502..07200f5a 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -14,11 +14,15 @@ on:
   schedule:
     - cron: '0 6 * * 1'  # "At 06:00 on Monday."
 
+permissions: {}
+
 jobs:
   update-dependencies:
     name: Update dependencies
     if: github.repository_owner == 'pypa' || github.event_name != 'schedule'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
 
     # we use this step to grab a Github App auth token, so that PRs generated by this workflow