diff --git a/.github/workflows/build-nightly-docker.yml b/.github/workflows/build-nightly-docker.yml
index 3a906caaf5..b80caf2ee0 100644
--- a/.github/workflows/build-nightly-docker.yml
+++ b/.github/workflows/build-nightly-docker.yml
@@ -14,6 +14,9 @@ env:
   DOCKER_IMAGE: 'ghcr.io/pytorch/torchbench:latest'
   HUGGING_FACE_HUB_TOKEN: ${{ secrets.HUGGING_FACE_HUB_TOKEN }}
 
+permissions:
+  contents: read
+
 jobs:
   build-push-docker:
     if: ${{ github.repository_owner == 'pytorch' }}
diff --git a/.github/workflows/clean-nightly-docker.yml b/.github/workflows/clean-nightly-docker.yml
index 5c5dde596d..032742dd58 100644
--- a/.github/workflows/clean-nightly-docker.yml
+++ b/.github/workflows/clean-nightly-docker.yml
@@ -5,6 +5,9 @@ on:
     # Cleanup the nightly Docker images every 3 months
     - cron: '0 0 1 */3 *'
 
+permissions:
+  contents: read
+
 jobs:
   clean-push-docker:
     if: ${{ github.repository_owner == 'pytorch' }}
diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml
index 71cbd12b91..fddf94ff83 100644
--- a/.github/workflows/pr-test.yml
+++ b/.github/workflows/pr-test.yml
@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy: