diff --git a/.github/workflows/ci-linux.yml b/.github/workflows/ci-linux.yml
index a3f65cf7..4a72e6b2 100644
--- a/.github/workflows/ci-linux.yml
+++ b/.github/workflows/ci-linux.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: ubuntu-18.04
     timeout-minutes: 120
 
+    permissions: read-all|write-all
+
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE.
       - uses: actions/checkout@v2
diff --git a/.github/workflows/ci-macos.yml b/.github/workflows/ci-macos.yml
index 7babbd88..161080a0 100644
--- a/.github/workflows/ci-macos.yml
+++ b/.github/workflows/ci-macos.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 120
 
+    permissions: read-all|write-all
+
     strategy:
       matrix:
         config:
diff --git a/.github/workflows/ci-win.yml b/.github/workflows/ci-win.yml
index 053e593a..2ad0a18d 100644
--- a/.github/workflows/ci-win.yml
+++ b/.github/workflows/ci-win.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: windows-2019
     timeout-minutes: 120
 
+    permissions: read-all|write-all
+
     strategy:
       matrix:
         config: