diff --git a/.github/workflows/build_and_push_docker_images.yaml b/.github/workflows/build_and_push_docker_images.yaml
index 62399575c..ea67ffbf5 100644
--- a/.github/workflows/build_and_push_docker_images.yaml
+++ b/.github/workflows/build_and_push_docker_images.yaml
@@ -75,6 +75,9 @@ on:
         type: string
         default: '["self-hosted","ephemeral", "linux"]'
 
+permissions:
+  contents: read
+
 jobs:
   docker:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/build_docker_for_test.yaml b/.github/workflows/build_docker_for_test.yaml
index a71bb96d9..3983f3fa9 100644
--- a/.github/workflows/build_docker_for_test.yaml
+++ b/.github/workflows/build_docker_for_test.yaml
@@ -23,6 +23,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   docker:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/check_deps_integrity.yaml b/.github/workflows/check_deps_integrity.yaml
index 1b260fae9..df7170523 100644
--- a/.github/workflows/check_deps_integrity.yaml
+++ b/.github/workflows/check_deps_integrity.yaml
@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   check_deps_integrity:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index a0b701d17..7e2057e30 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -8,6 +8,9 @@ on:
       ref:
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -15,7 +18,6 @@ jobs:
     timeout-minutes: 360
     permissions:
       actions: read
-      contents: read
       security-events: write
     container:
       image: ghcr.io/emqx/emqx-builder/5.1-4:1.14.5-25.3.2-2-ubuntu22.04
diff --git a/.github/workflows/green_master.yaml b/.github/workflows/green_master.yaml
index d7d4517d3..de343a8f9 100644
--- a/.github/workflows/green_master.yaml
+++ b/.github/workflows/green_master.yaml
@@ -8,6 +8,9 @@ on:
     - cron: "0 * * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   rerun-failed-jobs:
     if: github.repository_owner == 'emqx'
diff --git a/.github/workflows/performance_test.yaml b/.github/workflows/performance_test.yaml
index 224cfb0b3..5c938481e 100644
--- a/.github/workflows/performance_test.yaml
+++ b/.github/workflows/performance_test.yaml
@@ -19,6 +19,9 @@ env:
   TF_VAR_prometheus_remote_write_url: ${{ secrets.TF_EMQX_PERF_TEST_PROMETHEUS_REMOTE_WRITE_URL }}
   SLACK_WEBHOOK_URL: ${{ secrets.TF_EMQX_PERF_TEST_SLACK_URL }}
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ab145a764..b23f91128 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,9 +13,14 @@ on:
         required: true
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   upload:
     runs-on: ubuntu-22.04
+    permissions:
+      packages: write
     strategy:
       fail-fast: false
     steps:
diff --git a/.github/workflows/run_conf_tests.yaml b/.github/workflows/run_conf_tests.yaml
index a69746d76..e218ae838 100644
--- a/.github/workflows/run_conf_tests.yaml
+++ b/.github/workflows/run_conf_tests.yaml
@@ -14,6 +14,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   run_conf_tests:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/run_docker_tests.yaml b/.github/workflows/run_docker_tests.yaml
index 18dd9ac38..08391611f 100644
--- a/.github/workflows/run_docker_tests.yaml
+++ b/.github/workflows/run_docker_tests.yaml
@@ -17,6 +17,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   basic-tests:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/run_emqx_app_tests.yaml b/.github/workflows/run_emqx_app_tests.yaml
index c5554805a..695ad4750 100644
--- a/.github/workflows/run_emqx_app_tests.yaml
+++ b/.github/workflows/run_emqx_app_tests.yaml
@@ -26,6 +26,9 @@ on:
 env:
   IS_CI: "yes"
 
+permissions:
+  contents: read
+
 jobs:
   run_emqx_app_tests:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/run_helm_tests.yaml b/.github/workflows/run_helm_tests.yaml
index 9c314afde..c8f46948c 100644
--- a/.github/workflows/run_helm_tests.yaml
+++ b/.github/workflows/run_helm_tests.yaml
@@ -17,6 +17,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   helm_test:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}
diff --git a/.github/workflows/run_relup_tests.yaml b/.github/workflows/run_relup_tests.yaml
index a38ccae4f..b110e8512 100644
--- a/.github/workflows/run_relup_tests.yaml
+++ b/.github/workflows/run_relup_tests.yaml
@@ -14,6 +14,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   relup_test_plan:
     runs-on: ["${{ inputs.runner }}", 'linux', 'x64', 'ephemeral']
diff --git a/.github/workflows/spellcheck.yaml b/.github/workflows/spellcheck.yaml
index 08f6c2c38..57e6ac214 100644
--- a/.github/workflows/spellcheck.yaml
+++ b/.github/workflows/spellcheck.yaml
@@ -11,6 +11,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   spellcheck:
     strategy:
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index eb8038dcc..d26ae79c2 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -8,6 +8,9 @@ on:
     - cron: "0 * * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     if: github.repository_owner == 'emqx'
diff --git a/.github/workflows/static_checks.yaml b/.github/workflows/static_checks.yaml
index 758c3712b..7014c3365 100644
--- a/.github/workflows/static_checks.yaml
+++ b/.github/workflows/static_checks.yaml
@@ -20,6 +20,9 @@ on:
 env:
   IS_CI: "yes"
 
+permissions:
+  contents: read
+
 jobs:
   static_checks:
     runs-on: ${{ fromJSON(inputs.runner_labels) }}