diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3a47716..d4225c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 85d9dae..cab06d5 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -10,10 +10,12 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  security-events: write
+  contents: read
 
 jobs:
   sbom:
+    permissions:
+      contents: write
+      security-events: write
     uses: szl-holdings/.github/.github/workflows/reusable-sbom.yml@ebd2128c691b850c84438b671fbb512945933776
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2304d76..8439df8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,11 +12,11 @@ on:
 
 permissions:
   contents: read
-  security-events: write
-  id-token: write
-  actions: read
 
 jobs:
   scorecard:
+    permissions:
+      security-events: write
+      id-token: write
     uses: szl-holdings/.github/.github/workflows/reusable-scorecard.yml@ebd2128c691b850c84438b671fbb512945933776
     secrets: inherit
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 69ca423..c8266f4 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -12,9 +12,10 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   trivy:
+    permissions:
+      security-events: write
     uses: szl-holdings/.github/.github/workflows/reusable-trivy.yml@ebd2128c691b850c84438b671fbb512945933776
     secrets: inherit