diff --git a/.github/workflows/build-test-coverage.yml b/.github/workflows/build-test-coverage.yml
index 5992ee1..83188e3 100644
--- a/.github/workflows/build-test-coverage.yml
+++ b/.github/workflows/build-test-coverage.yml
@@ -2,6 +2,9 @@ name: Build Test & Coverage
 on:
     [pull_request, push]
 
+permissions:
+  contents: read
+
 jobs:
 
   test:
@@ -27,6 +30,7 @@ jobs:
         with: 
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true  
+          use_pypi: true
 
   code-style:
     name: Code style
diff --git a/.github/workflows/build-test-release.yml b/.github/workflows/build-test-release.yml
index 4fe90ee..4428116 100644
--- a/.github/workflows/build-test-release.yml
+++ b/.github/workflows/build-test-release.yml
@@ -3,6 +3,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
 
   release:
diff --git a/.github/workflows/repolinter.yml b/.github/workflows/repolinter.yml
index acb921f..ff01576 100644
--- a/.github/workflows/repolinter.yml
+++ b/.github/workflows/repolinter.yml
@@ -8,10 +8,15 @@ name: Repolinter Action
 # filtered in the "Test Default Branch" step.
 on: [push, workflow_dispatch]
 
+permissions: read-all
+
 jobs:
   repolint:
     name: Run Repolinter
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
       - name: Test Default Branch
         id: default-branch