diff --git a/.github/workflows/clean-packages.yml b/.github/workflows/clean-packages.yml
index 4ac8dcfc..11ecb9e2 100644
--- a/.github/workflows/clean-packages.yml
+++ b/.github/workflows/clean-packages.yml
@@ -26,3 +26,6 @@ jobs:
           package-type: 'container'
           min-versions-to-keep: 10
           delete-only-untagged-versions: 'true'
+permissions:
+  contents: read
+  packages: write
\ No newline at end of file
diff --git a/.github/workflows/php-stan.yml b/.github/workflows/php-stan.yml
index aeccee0c..8dbad506 100644
--- a/.github/workflows/php-stan.yml
+++ b/.github/workflows/php-stan.yml
@@ -35,4 +35,7 @@ jobs:
 
       - name: 'Execute PHP Stan'
         working-directory: ./GaelO2
-        run: vendor/bin/phpstan analyse app/
\ No newline at end of file
+        run: vendor/bin/phpstan analyse app/
+permissions:
+  contents: read
+  packages: write
\ No newline at end of file
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index fa6401ba..f408a948 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -43,3 +43,6 @@ jobs:
           push: true
           pull: true
           tags: ${{ steps.meta.outputs.tags }}
+permissions:
+  contents: read
+  packages: write
\ No newline at end of file
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3852e4d3..d942ba68 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -77,3 +77,6 @@ jobs:
           # determined on this branch.
           diff-branch: GaelO2
           diff-storage: GaelO2_code_coverage
+permissions:
+  contents: read
+  packages: write
\ No newline at end of file