diff --git a/.github/workflows/docker_img.yaml b/.github/workflows/docker_img.yaml
index 429ace44280f..38a0ea027ff8 100644
--- a/.github/workflows/docker_img.yaml
+++ b/.github/workflows/docker_img.yaml
@@ -34,6 +34,10 @@ on:
               type: boolean
               default: false
 
+permissions:
+    contents: read
+    packages: write
+
 jobs:
     build_images_base:
         name: Build Docker CHIP Build images - base
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7c2c5625fae9..12d6b2243bd7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -30,6 +30,9 @@ concurrency:
         'workflow_dispatch' && github.run_number) || github.sha }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     code-lints:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/minimal-build.yaml b/.github/workflows/minimal-build.yaml
index ed37ed3f955e..281d05c71eea 100644
--- a/.github/workflows/minimal-build.yaml
+++ b/.github/workflows/minimal-build.yaml
@@ -26,6 +26,9 @@ concurrency:
     group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     minimal-all-clusters:
         name: Linux / configure build of all-clusters-app
diff --git a/.github/workflows/mypy-validation.yml b/.github/workflows/mypy-validation.yml
index e542fa2fe1b0..0b7537ecf232 100644
--- a/.github/workflows/mypy-validation.yml
+++ b/.github/workflows/mypy-validation.yml
@@ -31,6 +31,9 @@ on:
       - 'scripts/tests/chiptest/**/*.py'
       - 'scripts/tests/run_test_suite.py'
 
+permissions:
+  contents: read
+
 jobs:
   mypy-check:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pr-validation.yaml b/.github/workflows/pr-validation.yaml
index e9a77e5e0553..802733ee9dcc 100644
--- a/.github/workflows/pr-validation.yaml
+++ b/.github/workflows/pr-validation.yaml
@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
+permissions: {}
+
 jobs:
   check_testing_header:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/protocol_compatibility.yaml b/.github/workflows/protocol_compatibility.yaml
index b13141a530b6..97ac18b7f680 100644
--- a/.github/workflows/protocol_compatibility.yaml
+++ b/.github/workflows/protocol_compatibility.yaml
@@ -18,6 +18,9 @@ on:
     paths:
       - "src/controller/data_model/controller-clusters.matter"
 
+permissions:
+  contents: read
+
 jobs:
   check_clusters_matter:
     name: Check controller-clusters.matter backwards compatibility
diff --git a/.github/workflows/qemu.yaml b/.github/workflows/qemu.yaml
index f66c97477503..453054d8e8e9 100644
--- a/.github/workflows/qemu.yaml
+++ b/.github/workflows/qemu.yaml
@@ -29,6 +29,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
 
     qemu-esp32:
diff --git a/.github/workflows/release_artifacts.yaml b/.github/workflows/release_artifacts.yaml
index 3ee56f0a6d8e..390a0c010196 100644
--- a/.github/workflows/release_artifacts.yaml
+++ b/.github/workflows/release_artifacts.yaml
@@ -24,6 +24,9 @@ on:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: write
+
 jobs:
     esp32:
         name: ESP32
diff --git a/.github/workflows/restyled.yml b/.github/workflows/restyled.yml
index e2845f6e7f3b..f50bf964fa68 100644
--- a/.github/workflows/restyled.yml
+++ b/.github/workflows/restyled.yml
@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   restyled:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/roll_and_build_docker.yaml b/.github/workflows/roll_and_build_docker.yaml
index 82506ed4ca29..fde4220809fc 100644
--- a/.github/workflows/roll_and_build_docker.yaml
+++ b/.github/workflows/roll_and_build_docker.yaml
@@ -1,6 +1,10 @@
 name: Manually Roll, Build, and Push Docker Images
 on:
   workflow_dispatch:
+
+permissions:
+  contents: write
+
 jobs:
   roll_version:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/smoketest-android.yaml b/.github/workflows/smoketest-android.yaml
index e4089858d7c0..fb2079264fdf 100644
--- a/.github/workflows/smoketest-android.yaml
+++ b/.github/workflows/smoketest-android.yaml
@@ -26,6 +26,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     android:
         name: Smoke Run - Android
diff --git a/.github/workflows/spell.yml b/.github/workflows/spell.yml
index 522a66e27998..45a41c2e8260 100644
--- a/.github/workflows/spell.yml
+++ b/.github/workflows/spell.yml
@@ -27,6 +27,9 @@ on:
             - "**.md"
             - ".github/.wordlist.txt"
 
+permissions:
+    contents: read
+
 jobs:
     check-spellcheck:
         name: Check Spelling - pyspelling
diff --git a/.github/workflows/tag-releases.yaml b/.github/workflows/tag-releases.yaml
index e349e8ce38c9..da67e877f2ca 100644
--- a/.github/workflows/tag-releases.yaml
+++ b/.github/workflows/tag-releases.yaml
@@ -25,6 +25,10 @@ on:
     #     description: 'Branch'
     #     required: false
     #     type: string
+
+permissions:
+  contents: write
+
 jobs:
     tag_main_release:
         name: Tag Current Release
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 20fa4ac1de01..2dcb5c91f898 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -42,6 +42,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     test_suites_linux:
         name: Test Suites - Linux
diff --git a/.github/workflows/third-party-check.yaml b/.github/workflows/third-party-check.yaml
index fac291941958..e542af4a2ded 100644
--- a/.github/workflows/third-party-check.yaml
+++ b/.github/workflows/third-party-check.yaml
@@ -23,6 +23,8 @@ on:
             - ".gitmodules"
         types: [opened, synchronize, reopened, labeled, unlabeled]
 
+permissions: {}
+
 jobs:
     check-submodule-update-label:
         name: Check For Submodule Update Label
diff --git a/.github/workflows/unit_integration_test.yaml b/.github/workflows/unit_integration_test.yaml
index bd093810ed97..b60b5b3075c0 100644
--- a/.github/workflows/unit_integration_test.yaml
+++ b/.github/workflows/unit_integration_test.yaml
@@ -26,6 +26,9 @@ concurrency:
     group: ${{ github.ref }}-${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.number) || (github.event_name == 'workflow_dispatch' && github.run_number) || github.sha }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     unit_tests:
         name: Unit / Integration Tests
diff --git a/.github/workflows/zap_regeneration.yaml b/.github/workflows/zap_regeneration.yaml
index f1b4c385502b..f775b5c0c61c 100644
--- a/.github/workflows/zap_regeneration.yaml
+++ b/.github/workflows/zap_regeneration.yaml
@@ -24,6 +24,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     zap_regeneration:
         name: ZAP Regeneration
diff --git a/.github/workflows/zap_templates.yaml b/.github/workflows/zap_templates.yaml
index a586b0f829ce..cb7207d62ca0 100644
--- a/.github/workflows/zap_templates.yaml
+++ b/.github/workflows/zap_templates.yaml
@@ -29,6 +29,9 @@ concurrency:
 env:
     CHIP_LOG_TIMESTAMPS: false
 
+permissions:
+    contents: read
+
 jobs:
     zap_templates:
         name: ZAP templates generation