diff --git a/.github/workflows/buildtools-tinygo.yaml b/.github/workflows/buildtools-tinygo.yaml
index 642a992..5447fdc 100644
--- a/.github/workflows/buildtools-tinygo.yaml
+++ b/.github/workflows/buildtools-tinygo.yaml
@@ -16,6 +16,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v3
 
diff --git a/.github/workflows/buildtools-wasi-sdk.yaml b/.github/workflows/buildtools-wasi-sdk.yaml
index 36c0362..55126bf 100644
--- a/.github/workflows/buildtools-wasi-sdk.yaml
+++ b/.github/workflows/buildtools-wasi-sdk.yaml
@@ -16,6 +16,9 @@ on:
 jobs:
   build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v3
 
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 74a9104..0282ec2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -17,6 +17,9 @@ env:
 jobs:
   build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Check out code
         uses: actions/checkout@v3