diff --git a/.github/workflows/automated_release.yaml b/.github/workflows/automated_release.yaml
index a38e0e71..d82b7d9d 100644
--- a/.github/workflows/automated_release.yaml
+++ b/.github/workflows/automated_release.yaml
@@ -5,6 +5,9 @@ on:
   schedule:
     - cron: "30 5 * * 1"
 
+permissions:
+  contents: write
+
 jobs:
   release_management:
     uses: newrelic/coreint-automation/.github/workflows/reusable_release_automation.yaml@v3
diff --git a/.github/workflows/on_prerelease.yaml b/.github/workflows/on_prerelease.yaml
index e461a702..3ee5e0b8 100644
--- a/.github/workflows/on_prerelease.yaml
+++ b/.github/workflows/on_prerelease.yaml
@@ -6,6 +6,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: write
+
 jobs:
   pre-release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_pre_release.yaml@v3
diff --git a/.github/workflows/on_push_pr.yaml b/.github/workflows/on_push_pr.yaml
index f9003b19..c8eab14b 100644
--- a/.github/workflows/on_push_pr.yaml
+++ b/.github/workflows/on_push_pr.yaml
@@ -7,6 +7,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   push-pr:
     uses: newrelic/coreint-automation/.github/workflows/reusable_push_pr.yaml@v3
diff --git a/.github/workflows/on_release.yaml b/.github/workflows/on_release.yaml
index 169d3a2f..d56315bb 100644
--- a/.github/workflows/on_release.yaml
+++ b/.github/workflows/on_release.yaml
@@ -7,6 +7,9 @@ on:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     uses: newrelic/coreint-automation/.github/workflows/reusable_on_release.yaml@v3
diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml
index 6ca54d4b..b06b6514 100644
--- a/.github/workflows/repolinter.yml
+++ b/.github/workflows/repolinter.yml
@@ -6,6 +6,9 @@ on:
   push:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   repolinter:
     uses: newrelic/coreint-automation/.github/workflows/reusable_repolinter.yaml@v3
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 049282aa..c3f3de8c 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: "0 3 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   security:
     uses: newrelic/coreint-automation/.github/workflows/reusable_security.yaml@v3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f346c9c..160ab85e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ Unreleased section should follow [Release Toolkit](https://github.com/newrelic/r
 ## Unreleased
 
 ### Security
+- Added explicit least-privilege `permissions` blocks to GitHub Actions workflows
 - Bumped golang.org/x/text to v0.39.0 and golang.org/x/sys to v0.44.0 to patch CVEs
 
 ## v1.23.2 - 2026-07-13