diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index b26dc30..7e42c47 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -5,6 +5,13 @@ on:
   schedule:
     - cron: '10 1/3 * * *'
 
+
+# dessant/lock-threads locks closed issues, PRs and discussions.
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
 jobs:
   lock:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-any.yml b/.github/workflows/pr-any.yml
index 541eb81..3d7fd1a 100644
--- a/.github/workflows/pr-any.yml
+++ b/.github/workflows/pr-any.yml
@@ -1,6 +1,11 @@
 name: PR
 on: [pull_request]
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   pr:
     strategy:
diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml
index 4082c93..3c4ba2c 100644
--- a/.github/workflows/push-master.yml
+++ b/.github/workflows/push-master.yml
@@ -4,6 +4,11 @@ on:
     branches:
       - master
 
+
+# Writes go through a separate bot token or app token; GITHUB_TOKEN stays read-only.
+permissions:
+  contents: read
+
 jobs:
   master:
     if: "! startsWith(github.event.head_commit.message, '[CI Skip]')"