diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02a2692..203a63d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd628f6..00dc764 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
diff --git a/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml b/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml
index 91558e6..d9fc379 100644
--- a/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml
+++ b/src/generators/default-content/templates/static/.github/workflows/update-package-lock.yml
@@ -3,6 +3,10 @@ on:
   schedule:
     - cron: "30 12 * * 1-5" # Mon-Fri 8:30AM EDT. 7:30AM EST.
   workflow_dispatch: # manual trigger
+
+permissions:
+  pull-requests: write
+
 jobs:
   update:
     name: Update
diff --git a/src/generators/release/templates/static/.github/workflows/release.yml b/src/generators/release/templates/static/.github/workflows/release.yml
index 2c8bc4a..cd11a4b 100644
--- a/src/generators/release/templates/static/.github/workflows/release.yml
+++ b/src/generators/release/templates/static/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release
diff --git a/src/generators/static-site/templates/.github/workflows/publish.yml b/src/generators/static-site/templates/.github/workflows/publish.yml
index c49595b..5cf898f 100644
--- a/src/generators/static-site/templates/.github/workflows/publish.yml
+++ b/src/generators/static-site/templates/.github/workflows/publish.yml
@@ -5,6 +5,10 @@ on:
       - main
       - '[0-9]+.x'
       - '[0-9]+.[0-9]+.x'
+
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish
diff --git a/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml b/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml
index 130d122..5556c69 100644
--- a/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml
+++ b/src/generators/test-unit-axe/templates/static/.github/workflows/ci-test-reporting.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml b/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml
index a39b5d0..cadd409 100644
--- a/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml
+++ b/src/generators/test-unit-axe/templates/static/.github/workflows/ci.yml
@@ -1,5 +1,9 @@
 name: CI
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
diff --git a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml
index f322249..bc8df60 100644
--- a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml
+++ b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff-test-reporting.yml
@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5
diff --git a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml
index 33d4e9f..c094217 100644
--- a/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml
+++ b/src/generators/test-vdiff/templates/static/.github/workflows/vdiff.yml
@@ -1,5 +1,12 @@
 name: vdiff
 on: pull_request
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+  statuses: write
+
 jobs:
   vdiff:
     timeout-minutes: 5