diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index 722bad0..a6dde02 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -17,11 +17,16 @@
 
 name: Enforce clang-format
 
+# Drop permissions to minimum, for security
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
+  workflow_dispatch:
 
 jobs:
   clang-format:
diff --git a/.github/workflows/linux-mingw.yml b/.github/workflows/linux-mingw.yml
index e6bba8b..2daa76c 100644
--- a/.github/workflows/linux-mingw.yml
+++ b/.github/workflows/linux-mingw.yml
@@ -17,11 +17,16 @@
 
 name: Build on Linux
 
+# Drop permissions to minimum, for security
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
+  workflow_dispatch:
 
 jobs:
   linux-mingw:
diff --git a/.github/workflows/windows-msvc.yml b/.github/workflows/windows-msvc.yml
index 55201e0..1bbb80e 100644
--- a/.github/workflows/windows-msvc.yml
+++ b/.github/workflows/windows-msvc.yml
@@ -17,11 +17,16 @@
 
 name: Build on Windows
 
+# Drop permissions to minimum, for security
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
+  workflow_dispatch:
 
 jobs:
   windows-msvc: