diff --git a/.github/workflows/codecov_code_coverage.yml b/.github/workflows/codecov_code_coverage.yml
index 61faad011..ca34fbf84 100644
--- a/.github/workflows/codecov_code_coverage.yml
+++ b/.github/workflows/codecov_code_coverage.yml
@@ -9,6 +9,9 @@ on:
       - 'main'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/notify_pull_request.yml b/.github/workflows/notify_pull_request.yml
index 5d9403186..2e7f39bf0 100644
--- a/.github/workflows/notify_pull_request.yml
+++ b/.github/workflows/notify_pull_request.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, ready_for_review, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   notify:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/notify_release.yml b/.github/workflows/notify_release.yml
index df537a037..1531f9e34 100644
--- a/.github/workflows/notify_release.yml
+++ b/.github/workflows/notify_release.yml
@@ -9,6 +9,9 @@ on:
     types: [created, published]
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
 jobs:
   # This workflow contains a single job called "notify"
   notify:
diff --git a/.github/workflows/pr_title_checker.yml b/.github/workflows/pr_title_checker.yml
index e3fb011ca..617b859a8 100644
--- a/.github/workflows/pr_title_checker.yml
+++ b/.github/workflows/pr_title_checker.yml
@@ -10,6 +10,9 @@ on:
       - labeled
       - unlabeled
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release_pr.yml b/.github/workflows/release_pr.yml
index 51d3a5078..cf1522d85 100644
--- a/.github/workflows/release_pr.yml
+++ b/.github/workflows/release_pr.yml
@@ -18,6 +18,10 @@ env:
   GIT_USER_NAME: amplify-android-dev+ghops
   GIT_USER_EMAIL: amplify-android-dev+ghops@amazon.com
   BASE_BRANCH: ${{ github.ref_name }}
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   create_pr_for_next_release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 4cd090ce2..517aaa5c5 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -4,6 +4,10 @@ on:
   schedule:
   - cron: "30 1 * * *"
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest