diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 9026643d7b2e..9cfaf20d6cf0 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,6 +7,9 @@ on:
   push:
     branches:
       - 'main'
+      
+# Declare default permissions as read only.
+permissions: read-all
 
 jobs:
   mirror_job:
diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml
index 825a3afd8508..54cae2deca98 100644
--- a/.github/workflows/pull_request_label.yml
+++ b/.github/workflows/pull_request_label.yml
@@ -12,6 +12,9 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened, closed]
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   label:
     permissions:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1bf50a0d1dfc..a67f8f1575e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,9 @@ on:
     branches:
       - main
 
+# Declare default permissions as read only.
+permissions: read-all
+
 jobs:
   release:
     if: github.repository_owner == 'flutter'