diff --git a/.github/constants.env b/.github/constants.env
index 4fa793aba..36299dee3 100644
--- a/.github/constants.env
+++ b/.github/constants.env
@@ -1,2 +1,3 @@
-DOTNET_VERSION_STABLE: '9.0.x'
+DOTNET_VERSION_CURRENT_STABLE: '9.0.x'
+DOTNET_8_VERSION_STABLE: '8.0.x'
 DOTNET_VERSION_PREVIEW: ''
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7417d9c73..d2962cce3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,6 +40,8 @@ on:
         required: true
         type: boolean
 
+permissions: read
+
 jobs:
   build:
     if: ${{ inputs.should_run }}
@@ -75,7 +77,8 @@ jobs:
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: |
-            ${{ env.DOTNET_VERSION_STABLE }}
+            ${{ env.DOTNET_VERSION_CURRENT_STABLE }}
+            ${{ env.DOTNET_8_VERSION_STABLE }}
 
       - name: Restore dependencies
         run: dotnet restore
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a8632bec3..60dae2b44 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,6 +26,8 @@ on:
       - 'src/**'
       - 'docs/**'
 
+permissions: read
+
 jobs:
   init:
     runs-on: windows-latest
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 4a1225ae4..7a7aefd91 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -19,6 +19,8 @@ on:
         required: true
         type: string
 
+permissions: read
+
 jobs:
   build:
     if: ${{ inputs.should_run }}
@@ -43,7 +45,8 @@ jobs:
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: |
-            ${{ env.DOTNET_VERSION_STABLE }}
+            ${{ env.DOTNET_VERSION_CURRENT_STABLE }}
+            ${{ env.DOTNET_8_VERSION_STABLE }}
 
       - name: Setup DocFX
         run: dotnet tool update -g docfx
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 519247562..02e9a75ee 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -13,6 +13,8 @@ on:
       - 'Source/**'
       - 'src/**'
 
+permissions: read
+
 jobs:
   sonarcloud:
     name: SonarCloud
@@ -33,7 +35,8 @@ jobs:
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: |
-            ${{ env.DOTNET_VERSION_STABLE }}
+            ${{ env.DOTNET_VERSION_CURRENT_STABLE }}
+            ${{ env.DOTNET_8_VERSION_STABLE }}
 
       - name: Install SonarCloud scanner
         if: steps.cache-sonar-scanner.outputs.cache-hit != 'true'