diff --git a/.github/workflows/javadoc-generation.yml b/.github/workflows/javadoc-generation.yml
index 129694229c..856b38e7c2 100644
--- a/.github/workflows/javadoc-generation.yml
+++ b/.github/workflows/javadoc-generation.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
-      contents: write     # Needed for checkout and potential deployment
+      contents: read      # Needed for checkout
       pages: write        # Needed for GitHub Pages deployment
       id-token: write     # Required for attestation
       actions: read       # Basic read access to actions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a15418bf1..7722cc9992 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,15 +21,10 @@ jobs:
       cancel-in-progress: true
     permissions:
       contents: write     # Needed for checkout, git-auto-commit-action, and creating releases
-      packages: write     # Needed for publishing packages
       id-token: write    # Required for SLSA provenance and SBOM attestation
       actions: read      # Basic read access to actions
-      security-events: write  # Needed for SBOM attestation
-      statuses: write    # Required for commit statuses updated by actions
       issues: write       # Updated to write for release-drafter
       pull-requests: write    # Updated to write for release-drafter      
-      pages: read
-      deployments: write
       attestations: write # Required to create and persist attestations
     strategy:
       fail-fast: false
diff --git a/.github/workflows/site-generation.yml b/.github/workflows/site-generation.yml
index 1ea87b74ce..9feb4c9c6b 100644
--- a/.github/workflows/site-generation.yml
+++ b/.github/workflows/site-generation.yml
@@ -17,9 +17,7 @@ jobs:
     runs-on: ubuntu-26.04
     timeout-minutes: 120
     permissions:
-      contents: write     # Needed for checkout and potential site deployment
-      pages: write        # Needed for GitHub Pages deployment
-      id-token: write     # Required for attestation
+      contents: read      # Needed for checkout
       actions: read       # Basic read access to actions
 
     steps: