diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 01fdce3..e3f9d5e 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -19,7 +19,8 @@ concurrency:
   group: check-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   format:
diff --git a/.github/workflows/netlify-deploy.yml b/.github/workflows/netlify-deploy.yml
index b7b082d..bff7fcd 100644
--- a/.github/workflows/netlify-deploy.yml
+++ b/.github/workflows/netlify-deploy.yml
@@ -5,6 +5,11 @@ on:
   workflow_call:
   workflow_dispatch:
 
+permissions:
+  contents: write
+  statuses: write
+  deployments: write
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release-guide.yml b/.github/workflows/release-guide.yml
index 73676af..8df50cf 100644
--- a/.github/workflows/release-guide.yml
+++ b/.github/workflows/release-guide.yml
@@ -6,16 +6,19 @@ on:
     tags:
       - "nixos-branding-guide-v*.*.*"
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
 
   release:
     needs: check
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
@@ -80,7 +83,14 @@ jobs:
   deploy:
     uses: ./.github/workflows/netlify-deploy.yml
     needs: release
+    permissions:
+      contents: write
+      statuses: write
+      deployments: write
 
   release-npm-package:
     uses: ./.github/workflows/release-npm-package.yaml
     needs: release
+    permissions:
+      id-token: write
+      contents: read