diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 6c576fa..5a9be67 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index 2886cc3..6e95981 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -1,5 +1,8 @@
 name: PR
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches:
@@ -15,8 +18,4 @@ concurrency:
 jobs:
   run_ci:
     name: Run CI
-    uses: ./.github/workflows/CI.yml
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
\ No newline at end of file
+    uses: ./.github/workflows/CI.yml
\ No newline at end of file
diff --git a/.github/workflows/check_docs.yml b/.github/workflows/check_docs.yml
index 22c6f90..298603d 100644
--- a/.github/workflows/check_docs.yml
+++ b/.github/workflows/check_docs.yml
@@ -1,5 +1,8 @@
 name: Check docs
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/check_examples.yml b/.github/workflows/check_examples.yml
index bf14dd0..c13dc3a 100644
--- a/.github/workflows/check_examples.yml
+++ b/.github/workflows/check_examples.yml
@@ -1,5 +1,8 @@
 name: Check examples
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/check_ni_datastore.yml b/.github/workflows/check_ni_datastore.yml
index 004a7cb..db96711 100644
--- a/.github/workflows/check_ni_datastore.yml
+++ b/.github/workflows/check_ni_datastore.yml
@@ -1,5 +1,8 @@
 name: Check analyzers
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/check_utilities.yml b/.github/workflows/check_utilities.yml
index 80a04d1..9e07bfe 100644
--- a/.github/workflows/check_utilities.yml
+++ b/.github/workflows/check_utilities.yml
@@ -1,5 +1,8 @@
 name: Check utilities
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 81c4314..c469287 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,8 @@
 name: Publish ni.datastore
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]
diff --git a/.github/workflows/run_unit_tests.yml b/.github/workflows/run_unit_tests.yml
index 7a784bd..d50ae68 100644
--- a/.github/workflows/run_unit_tests.yml
+++ b/.github/workflows/run_unit_tests.yml
@@ -1,5 +1,8 @@
 name: Run unit tests
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
diff --git a/.github/workflows/sync_github_issues_to_azdo.yml b/.github/workflows/sync_github_issues_to_azdo.yml
index 8c2f004..36adb92 100644
--- a/.github/workflows/sync_github_issues_to_azdo.yml
+++ b/.github/workflows/sync_github_issues_to_azdo.yml
@@ -1,5 +1,10 @@
 name: Sync issue to Azure DevOps work item
 
+# This workflow uses secrets.GH_REPO_TOKEN, which is not affected by the
+# permissions block. Since this workflow doesn't use the built-in
+# GITHUB_TOKEN, we can leave the permissions blank.
+permissions: {}
+
 on:
   issues:
     # Omit "labeled" and "unlabeled" to work around https://github.com/danhellem/github-actions-issue-to-work-item/issues/70