diff --git a/.github/workflows/codeowners.yml b/.github/workflows/codeowners.yml
index 1e2e5c9304ac..e210cacda14f 100644
--- a/.github/workflows/codeowners.yml
+++ b/.github/workflows/codeowners.yml
@@ -24,6 +24,9 @@ on:
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
+# We don't need any default GitHub token
+permissions: {}
+
 env:
   OWNERS_FILE: ci/OWNERS
   # Don't do anything on draft PRs
diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig.yml
index b4ef16a734b7..63264595bcc7 100644
--- a/.github/workflows/editorconfig.yml
+++ b/.github/workflows/editorconfig.yml
@@ -1,6 +1,8 @@
 name: "Checking EditorConfig"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors
diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos.yml
index 2ae4d929c12d..eed27f5565ed 100644
--- a/.github/workflows/manual-nixos.yml
+++ b/.github/workflows/manual-nixos.yml
@@ -1,6 +1,7 @@
 name: "Build NixOS manual"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs.yml
index 676a554107d5..14994e6c7542 100644
--- a/.github/workflows/manual-nixpkgs.yml
+++ b/.github/workflows/manual-nixpkgs.yml
@@ -1,6 +1,7 @@
 name: "Build Nixpkgs manual"
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request_target:
diff --git a/.github/workflows/nix-parse.yml b/.github/workflows/nix-parse.yml
index 352cb81d87ed..d3991424617c 100644
--- a/.github/workflows/nix-parse.yml
+++ b/.github/workflows/nix-parse.yml
@@ -1,6 +1,8 @@
 name: "Check whether nix files are parseable"
 
-permissions: read-all
+permissions:
+  pull-requests: read
+  contents: read
 
 on:
   # avoids approving first time contributors