diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e818d6f..54c7747 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -10,6 +10,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+    
     steps:
     - uses: actions/checkout@v4
     
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 3dd1dec..c2cd1b2 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -12,6 +12,11 @@ jobs:
   security:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+      security-events: write  # For CodeQL
+      actions: read
+    
     steps:
     - uses: actions/checkout@v4
     
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 16c492f..b02acb4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,6 +10,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     
+    permissions:
+      contents: read
+      pull-requests: write  # For coverage comments
+    
     services:
       postgres:
         image: postgres:15