diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index c446fc41ba..887dfabf05 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -12,7 +12,8 @@ on:
       - 'src/**'
       - 'test/fuzz/**'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 6c02b1da1e..25a1a6ebeb 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -5,7 +5,8 @@
 
 name: CIFuzz
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   pull_request:
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 7b1d1217f3..a164d16fbf 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -9,7 +9,8 @@ on:
     # Run Coverity daily at midnight
     - cron:  '0 0 * * *'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 3905b7a643..7bceabd5ce 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -10,7 +10,8 @@ on:
       - main
       - v[0-9]+-stable
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 533c8be968..6294742758 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -14,7 +14,8 @@ on:
       - main
       - v[0-9]+-stable
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   ci:
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
index 3f37fe866b..1458732d2b 100644
--- a/.github/workflows/unit_tests.yml
+++ b/.github/workflows/unit_tests.yml
@@ -9,7 +9,8 @@ on:
       - main
       - v[0-9]+-stable
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build: