diff --git a/.github/workflows/amplify-plugin-npm-publish.yml b/.github/workflows/amplify-plugin-npm-publish.yml
index da28764..381c4fe 100644
--- a/.github/workflows/amplify-plugin-npm-publish.yml
+++ b/.github/workflows/amplify-plugin-npm-publish.yml
@@ -4,6 +4,10 @@ on:
   release:
     types: [created]
 
+
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: "./aws-amplify-publisher-plugin"
diff --git a/.github/workflows/amplify-plugin-pull-request.yml b/.github/workflows/amplify-plugin-pull-request.yml
index ab4dd19..58ebc0a 100644
--- a/.github/workflows/amplify-plugin-pull-request.yml
+++ b/.github/workflows/amplify-plugin-pull-request.yml
@@ -3,6 +3,11 @@ name: Build/test/lint/CodeQL Publish Plugin
 on:
   pull_request:
 
+
+permissions:
+  contents: read
+  security-events: write
+
 defaults:
   run:
     working-directory: "./aws-amplify-publisher-plugin"
diff --git a/.github/workflows/host-plugin-npm-publish.yml b/.github/workflows/host-plugin-npm-publish.yml
index 6fd6f6e..509b027 100644
--- a/.github/workflows/host-plugin-npm-publish.yml
+++ b/.github/workflows/host-plugin-npm-publish.yml
@@ -4,6 +4,10 @@ on:
   release:
     types: [created]
 
+
+permissions:
+  contents: read
+
 defaults:
   run:
     working-directory: "./open-source-hosts-plugin"
diff --git a/.github/workflows/host-plugin-pull-request.yml b/.github/workflows/host-plugin-pull-request.yml
index eaf806c..7514355 100644
--- a/.github/workflows/host-plugin-pull-request.yml
+++ b/.github/workflows/host-plugin-pull-request.yml
@@ -3,6 +3,11 @@ name: Build/test/lint/CodeQL Host Plugin
 on:
   pull_request:
 
+
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}