diff --git a/.github/workflows/container-validation.yml b/.github/workflows/container-validation.yml
index 730dba5..78a710e 100644
--- a/.github/workflows/container-validation.yml
+++ b/.github/workflows/container-validation.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   simplerisk-jammy:
     name: 'Verify simplerisk/simplerisk image based on Ubuntu 22.04 (Jammy)'
diff --git a/.github/workflows/create_new_tag.yml b/.github/workflows/create_new_tag.yml
index 00a15b4..bbdf2b0 100644
--- a/.github/workflows/create_new_tag.yml
+++ b/.github/workflows/create_new_tag.yml
@@ -4,6 +4,9 @@ on:
   push:
     branches: [ "master" ]
 
+permissions:
+  contents: write   # git tag + git push --tags
+
 jobs:
   create-release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/promote-latest.yml b/.github/workflows/promote-latest.yml
index 750a6e0..d8af9f9 100644
--- a/.github/workflows/promote-latest.yml
+++ b/.github/workflows/promote-latest.yml
@@ -46,6 +46,7 @@ env:
 
 jobs:
   promote:
+    environment: release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/.github/workflows/publish-testing.yml b/.github/workflows/publish-testing.yml
index d25fc2b..7a8e6bd 100644
--- a/.github/workflows/publish-testing.yml
+++ b/.github/workflows/publish-testing.yml
@@ -42,6 +42,7 @@ env:
 
 jobs:
   publish:
+    environment: testing
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
diff --git a/.github/workflows/push-to-dockerhub.yml b/.github/workflows/push-to-dockerhub.yml
index a0dd924..c9c5f02 100644
--- a/.github/workflows/push-to-dockerhub.yml
+++ b/.github/workflows/push-to-dockerhub.yml
@@ -19,6 +19,9 @@ name: Push images to DockerHub
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # On a job that uses a reusable workflow, it seems you cannot
 # use env on a with block (https://github.com/actions/runner/issues/1189#issuecomment-1741672276)
 env:
diff --git a/.github/workflows/push-to-dockerhub_rw.yml b/.github/workflows/push-to-dockerhub_rw.yml
index 16e66b7..c4fe8da 100644
--- a/.github/workflows/push-to-dockerhub_rw.yml
+++ b/.github/workflows/push-to-dockerhub_rw.yml
@@ -42,6 +42,7 @@ on:
 
 jobs:
   dockerhub:
+    environment: release
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
diff --git a/.github/workflows/push-to-gh-pkgs.yml b/.github/workflows/push-to-gh-pkgs.yml
index 8152167..6c64788 100644
--- a/.github/workflows/push-to-gh-pkgs.yml
+++ b/.github/workflows/push-to-gh-pkgs.yml
@@ -15,6 +15,11 @@ name: Push images to GitHub Packages
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write   # callee push-to-gh-pkgs_rw pushes to ghcr.io
+  id-token: write   # callee cosign-signs via sigstore/fulcio
+
 # On a job that uses a reusable workflow, it seems you cannot
 # use env on a with block (https://github.com/actions/runner/issues/1189#issuecomment-1741672276)
 env:
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index d468de4..e02f773 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     name: ShellCheck