From dd46074153757c7fb816fc5c82e3a525c1b4d0cd Mon Sep 17 00:00:00 2001
From: aidan garske <aidan@wolfssl.com>
Date: Wed, 15 Jul 2026 16:16:21 -0700
Subject: [PATCH] 6707 - Add least-privilege permissions block to PR-triggered
 workflows

---
 .github/workflows/ada.yml                   | 3 +++
 .github/workflows/aesgcm-siv.yml            | 3 +++
 .github/workflows/arduino.yml               | 4 +++-
 .github/workflows/async-examples.yml        | 3 +++
 .github/workflows/async.yml                 | 3 +++
 .github/workflows/bind.yml                  | 3 +++
 .github/workflows/check-cert-chains.yml     | 3 +++
 .github/workflows/cmake-autoconf.yml        | 3 +++
 .github/workflows/cmake.yml                 | 3 +++
 .github/workflows/codespell.yml             | 3 +++
 .github/workflows/cross-wolfclu.yml         | 3 +++
 .github/workflows/cross-wolfmqtt.yml        | 3 +++
 .github/workflows/cross-wolfpkcs11.yml      | 3 +++
 .github/workflows/cross-wolfprovider.yml    | 3 +++
 .github/workflows/cross-wolfssh.yml         | 3 +++
 .github/workflows/cross-wolftpm.yml         | 3 +++
 .github/workflows/cryptocb-only.yml         | 3 +++
 .github/workflows/curl.yml                  | 3 +++
 .github/workflows/cyrus-sasl.yml            | 3 +++
 .github/workflows/disable-pk-algs.yml       | 3 +++
 .github/workflows/docker-Espressif.yml      | 3 +++
 .github/workflows/emnet-nonblock.yml        | 3 +++
 .github/workflows/fil-c.yml                 | 3 +++
 .github/workflows/freertos-mem-track.yml    | 3 +++
 .github/workflows/gencertbuf.yml            | 3 +++
 .github/workflows/grpc.yml                  | 3 +++
 .github/workflows/haproxy.yml               | 3 +++
 .github/workflows/hostap-vm.yml             | 3 +++
 .github/workflows/intelasm-c-fallback.yml   | 3 +++
 .github/workflows/ipmitool.yml              | 3 +++
 .github/workflows/jwt-cpp.yml               | 3 +++
 .github/workflows/krb5.yml                  | 3 +++
 .github/workflows/libspdm.yml               | 3 +++
 .github/workflows/libssh2.yml               | 3 +++
 .github/workflows/libvncserver.yml          | 3 +++
 .github/workflows/linuxkm.yml               | 3 +++
 .github/workflows/mbedtls.yml               | 3 +++
 .github/workflows/membrowse-report.yml      | 3 +++
 .github/workflows/memcached.yml             | 3 +++
 .github/workflows/mono.yml                  | 3 +++
 .github/workflows/mosquitto.yml             | 3 +++
 .github/workflows/msmtp.yml                 | 3 +++
 .github/workflows/msys2.yml                 | 3 +++
 .github/workflows/multi-arch.yml            | 3 +++
 .github/workflows/multi-compiler.yml        | 3 +++
 .github/workflows/net-snmp.yml              | 3 +++
 .github/workflows/nginx.yml                 | 3 +++
 .github/workflows/no-malloc.yml             | 3 +++
 .github/workflows/nss.yml                   | 3 +++
 .github/workflows/ntp.yml                   | 3 +++
 .github/workflows/ocsp.yml                  | 3 +++
 .github/workflows/openldap.yml              | 3 +++
 .github/workflows/openssh.yml               | 3 +++
 .github/workflows/openssl-ech.yml           | 3 +++
 .github/workflows/opensslcoexist.yml        | 3 +++
 .github/workflows/openvpn.yml               | 3 +++
 .github/workflows/os-check.yml              | 3 +++
 .github/workflows/packaging.yml             | 3 +++
 .github/workflows/pam-ipmi.yml              | 3 +++
 .github/workflows/pq-all.yml                | 3 +++
 .github/workflows/pr-commit-check.yml       | 3 +++
 .github/workflows/psk.yml                   | 3 +++
 .github/workflows/puf.yml                   | 3 +++
 .github/workflows/python.yml                | 3 +++
 .github/workflows/rng-tools.yml             | 3 +++
 .github/workflows/rtl8735b.yml              | 3 +++
 .github/workflows/rust-wrapper.yml          | 3 +++
 .github/workflows/smallStackSize.yml        | 3 +++
 .github/workflows/socat.yml                 | 3 +++
 .github/workflows/softhsm.yml               | 3 +++
 .github/workflows/sssd.yml                  | 3 +++
 .github/workflows/stunnel.yml               | 3 +++
 .github/workflows/symbol-prefixes.yml       | 3 +++
 .github/workflows/threadx.yml               | 3 +++
 .github/workflows/trackmemory.yml           | 3 +++
 .github/workflows/watcomc.yml               | 3 +++
 .github/workflows/win-csharp-test.yml       | 3 +++
 .github/workflows/windows-arm64.yml         | 3 +++
 .github/workflows/wolfCrypt-Wconversion.yml | 3 +++
 .github/workflows/wolfboot-integration.yml  | 3 +++
 .github/workflows/wolfsm.yml                | 3 +++
 .github/workflows/xcode.yml                 | 3 +++
 .github/workflows/zephyr-4.x.yml            | 3 +++
 .github/workflows/zephyr.yml                | 3 +++
 84 files changed, 252 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ada.yml b/.github/workflows/ada.yml
index 158b3e9397..35bf4672d2 100644
--- a/.github/workflows/ada.yml
+++ b/.github/workflows/ada.yml
@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/aesgcm-siv.yml b/.github/workflows/aesgcm-siv.yml
index f067f74700..b7c250f2e0 100644
--- a/.github/workflows/aesgcm-siv.yml
+++ b/.github/workflows/aesgcm-siv.yml
@@ -15,6 +15,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/arduino.yml b/.github/workflows/arduino.yml
index 2df14a8edf..95e2724501 100644
--- a/.github/workflows/arduino.yml
+++ b/.github/workflows/arduino.yml
@@ -71,10 +71,12 @@ on:
 
 concurrency:
   # Same branch push cancels other jobs. Other PR branches untouched
-
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/async-examples.yml b/.github/workflows/async-examples.yml
index caca4b6c32..5f55033e32 100644
--- a/.github/workflows/async-examples.yml
+++ b/.github/workflows/async-examples.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   async_examples:
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
diff --git a/.github/workflows/async.yml b/.github/workflows/async.yml
index b2c2a97e72..0b3f4947a2 100644
--- a/.github/workflows/async.yml
+++ b/.github/workflows/async.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/bind.yml b/.github/workflows/bind.yml
index b9cb22772c..9164461ad4 100644
--- a/.github/workflows/bind.yml
+++ b/.github/workflows/bind.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/check-cert-chains.yml b/.github/workflows/check-cert-chains.yml
index 4d4ec11fef..6c83a49f88 100644
--- a/.github/workflows/check-cert-chains.yml
+++ b/.github/workflows/check-cert-chains.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cmake-autoconf.yml b/.github/workflows/cmake-autoconf.yml
index 9d4c076e97..9f47987216 100644
--- a/.github/workflows/cmake-autoconf.yml
+++ b/.github/workflows/cmake-autoconf.yml
@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index 354f8d9e02..abe2a1ee59 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 0bf29f3fbd..6992ae2be2 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -10,6 +10,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cross-wolfclu.yml b/.github/workflows/cross-wolfclu.yml
index 39aa09a5f2..f777283a43 100644
--- a/.github/workflows/cross-wolfclu.yml
+++ b/.github/workflows/cross-wolfclu.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cross-wolfmqtt.yml b/.github/workflows/cross-wolfmqtt.yml
index fcaf78475e..fb880d1bda 100644
--- a/.github/workflows/cross-wolfmqtt.yml
+++ b/.github/workflows/cross-wolfmqtt.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cross-wolfpkcs11.yml b/.github/workflows/cross-wolfpkcs11.yml
index c321bef90d..bb675e30d6 100644
--- a/.github/workflows/cross-wolfpkcs11.yml
+++ b/.github/workflows/cross-wolfpkcs11.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cross-wolfprovider.yml b/.github/workflows/cross-wolfprovider.yml
index ec686c2cbe..ee06be8cf2 100644
--- a/.github/workflows/cross-wolfprovider.yml
+++ b/.github/workflows/cross-wolfprovider.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cross-wolfssh.yml b/.github/workflows/cross-wolfssh.yml
index b08d42a6c7..b9cf3946ed 100644
--- a/.github/workflows/cross-wolfssh.yml
+++ b/.github/workflows/cross-wolfssh.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cross-wolftpm.yml b/.github/workflows/cross-wolftpm.yml
index ac946369bd..f490cfcde7 100644
--- a/.github/workflows/cross-wolftpm.yml
+++ b/.github/workflows/cross-wolftpm.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cryptocb-only.yml b/.github/workflows/cryptocb-only.yml
index 2d645e9343..537cee3c03 100644
--- a/.github/workflows/cryptocb-only.yml
+++ b/.github/workflows/cryptocb-only.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/curl.yml b/.github/workflows/curl.yml
index 2bae21ff5b..09739b1f99 100644
--- a/.github/workflows/curl.yml
+++ b/.github/workflows/curl.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/cyrus-sasl.yml b/.github/workflows/cyrus-sasl.yml
index a05bab3361..5c1ad746e0 100644
--- a/.github/workflows/cyrus-sasl.yml
+++ b/.github/workflows/cyrus-sasl.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/disable-pk-algs.yml b/.github/workflows/disable-pk-algs.yml
index 655f48a98f..880bbb8293 100644
--- a/.github/workflows/disable-pk-algs.yml
+++ b/.github/workflows/disable-pk-algs.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/docker-Espressif.yml b/.github/workflows/docker-Espressif.yml
index 230ecd9da0..242f0e8d78 100644
--- a/.github/workflows/docker-Espressif.yml
+++ b/.github/workflows/docker-Espressif.yml
@@ -10,6 +10,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/emnet-nonblock.yml b/.github/workflows/emnet-nonblock.yml
index 893379639c..cc786507a1 100644
--- a/.github/workflows/emnet-nonblock.yml
+++ b/.github/workflows/emnet-nonblock.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 # Build wolfSSL with -DWOLFSSL_EMNET using the clean-room shim in
diff --git a/.github/workflows/fil-c.yml b/.github/workflows/fil-c.yml
index 2a0ff44371..b592870ba6 100644
--- a/.github/workflows/fil-c.yml
+++ b/.github/workflows/fil-c.yml
@@ -14,6 +14,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/freertos-mem-track.yml b/.github/workflows/freertos-mem-track.yml
index 29ebfaf4a7..e28aa7f072 100644
--- a/.github/workflows/freertos-mem-track.yml
+++ b/.github/workflows/freertos-mem-track.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 # Regression test for the memLock / pthread.h guard misalignment in
diff --git a/.github/workflows/gencertbuf.yml b/.github/workflows/gencertbuf.yml
index aac346ae09..7f5fad9623 100644
--- a/.github/workflows/gencertbuf.yml
+++ b/.github/workflows/gencertbuf.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/grpc.yml b/.github/workflows/grpc.yml
index 7095a2970d..1a443a58ba 100644
--- a/.github/workflows/grpc.yml
+++ b/.github/workflows/grpc.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/haproxy.yml b/.github/workflows/haproxy.yml
index 10ec6a1aa3..65b7c6a7d5 100644
--- a/.github/workflows/haproxy.yml
+++ b/.github/workflows/haproxy.yml
@@ -14,6 +14,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/hostap-vm.yml b/.github/workflows/hostap-vm.yml
index d663f5db25..2d66fa6015 100644
--- a/.github/workflows/hostap-vm.yml
+++ b/.github/workflows/hostap-vm.yml
@@ -14,6 +14,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 env:
diff --git a/.github/workflows/intelasm-c-fallback.yml b/.github/workflows/intelasm-c-fallback.yml
index 4d3f3ae18e..127df08a93 100644
--- a/.github/workflows/intelasm-c-fallback.yml
+++ b/.github/workflows/intelasm-c-fallback.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/ipmitool.yml b/.github/workflows/ipmitool.yml
index 4f11da7787..b5df5fbe12 100644
--- a/.github/workflows/ipmitool.yml
+++ b/.github/workflows/ipmitool.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 
diff --git a/.github/workflows/jwt-cpp.yml b/.github/workflows/jwt-cpp.yml
index cd4d6ffa60..e3263f3f99 100644
--- a/.github/workflows/jwt-cpp.yml
+++ b/.github/workflows/jwt-cpp.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/krb5.yml b/.github/workflows/krb5.yml
index 55fb7f9e87..80810e9a30 100644
--- a/.github/workflows/krb5.yml
+++ b/.github/workflows/krb5.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/libspdm.yml b/.github/workflows/libspdm.yml
index 6294b9a17d..66318ba68d 100644
--- a/.github/workflows/libspdm.yml
+++ b/.github/workflows/libspdm.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/libssh2.yml b/.github/workflows/libssh2.yml
index 2b440e694c..0a30726d4b 100644
--- a/.github/workflows/libssh2.yml
+++ b/.github/workflows/libssh2.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/libvncserver.yml b/.github/workflows/libvncserver.yml
index e73969de0e..18a0e27ffc 100644
--- a/.github/workflows/libvncserver.yml
+++ b/.github/workflows/libvncserver.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/linuxkm.yml b/.github/workflows/linuxkm.yml
index 8922f71bdf..8c404a4b0c 100644
--- a/.github/workflows/linuxkm.yml
+++ b/.github/workflows/linuxkm.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/mbedtls.yml b/.github/workflows/mbedtls.yml
index a6fcc04d55..724dc6cf71 100644
--- a/.github/workflows/mbedtls.yml
+++ b/.github/workflows/mbedtls.yml
@@ -14,6 +14,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 env:
diff --git a/.github/workflows/membrowse-report.yml b/.github/workflows/membrowse-report.yml
index e4dabc58a7..f7308819cd 100644
--- a/.github/workflows/membrowse-report.yml
+++ b/.github/workflows/membrowse-report.yml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   load-targets:
     # Only run from the wolfssl org to avoid burning forks' CI minutes
diff --git a/.github/workflows/memcached.yml b/.github/workflows/memcached.yml
index 7bd9b5b4e3..af98ac1ad9 100644
--- a/.github/workflows/memcached.yml
+++ b/.github/workflows/memcached.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/mono.yml b/.github/workflows/mono.yml
index 45b2c01a3a..36b632fde5 100644
--- a/.github/workflows/mono.yml
+++ b/.github/workflows/mono.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/mosquitto.yml b/.github/workflows/mosquitto.yml
index c960268383..49b515d274 100644
--- a/.github/workflows/mosquitto.yml
+++ b/.github/workflows/mosquitto.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/msmtp.yml b/.github/workflows/msmtp.yml
index ef02f75bdf..1596a8da22 100644
--- a/.github/workflows/msmtp.yml
+++ b/.github/workflows/msmtp.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/msys2.yml b/.github/workflows/msys2.yml
index e7a9644bb9..bc2ce93070 100644
--- a/.github/workflows/msys2.yml
+++ b/.github/workflows/msys2.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/multi-arch.yml b/.github/workflows/multi-arch.yml
index 0854c430d3..8de365c857 100644
--- a/.github/workflows/multi-arch.yml
+++ b/.github/workflows/multi-arch.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/multi-compiler.yml b/.github/workflows/multi-compiler.yml
index 3dc86dd94e..93fb49384b 100644
--- a/.github/workflows/multi-compiler.yml
+++ b/.github/workflows/multi-compiler.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/net-snmp.yml b/.github/workflows/net-snmp.yml
index 58eca4edac..78a0a6238a 100644
--- a/.github/workflows/net-snmp.yml
+++ b/.github/workflows/net-snmp.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/nginx.yml b/.github/workflows/nginx.yml
index 65d70838e6..faa160f6ec 100644
--- a/.github/workflows/nginx.yml
+++ b/.github/workflows/nginx.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 # clang has better sanitizer support
diff --git a/.github/workflows/no-malloc.yml b/.github/workflows/no-malloc.yml
index 1d9ab06561..ac1f6650ef 100644
--- a/.github/workflows/no-malloc.yml
+++ b/.github/workflows/no-malloc.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/nss.yml b/.github/workflows/nss.yml
index 338c968441..a86e981d29 100644
--- a/.github/workflows/nss.yml
+++ b/.github/workflows/nss.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 env:
diff --git a/.github/workflows/ntp.yml b/.github/workflows/ntp.yml
index 4cbe22b92c..23e4b36a25 100644
--- a/.github/workflows/ntp.yml
+++ b/.github/workflows/ntp.yml
@@ -14,6 +14,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/ocsp.yml b/.github/workflows/ocsp.yml
index bd46e8212a..861040ca59 100644
--- a/.github/workflows/ocsp.yml
+++ b/.github/workflows/ocsp.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/openldap.yml b/.github/workflows/openldap.yml
index cc5dcfc4ad..e681022b99 100644
--- a/.github/workflows/openldap.yml
+++ b/.github/workflows/openldap.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/openssh.yml b/.github/workflows/openssh.yml
index 84f73eec23..e512cca391 100644
--- a/.github/workflows/openssh.yml
+++ b/.github/workflows/openssh.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/openssl-ech.yml b/.github/workflows/openssl-ech.yml
index 21dca0a71e..b86167f750 100644
--- a/.github/workflows/openssl-ech.yml
+++ b/.github/workflows/openssl-ech.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/opensslcoexist.yml b/.github/workflows/opensslcoexist.yml
index 6b0f48f7b6..518b5ca168 100644
--- a/.github/workflows/opensslcoexist.yml
+++ b/.github/workflows/opensslcoexist.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/openvpn.yml b/.github/workflows/openvpn.yml
index 644909654c..c8773a9f6c 100644
--- a/.github/workflows/openvpn.yml
+++ b/.github/workflows/openvpn.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml
index 5efaea9398..3fd87c01ac 100644
--- a/.github/workflows/os-check.yml
+++ b/.github/workflows/os-check.yml
@@ -27,6 +27,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml
index 5e62521a96..7053ba755b 100644
--- a/.github/workflows/packaging.yml
+++ b/.github/workflows/packaging.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/pam-ipmi.yml b/.github/workflows/pam-ipmi.yml
index 02a385a359..de907d05af 100644
--- a/.github/workflows/pam-ipmi.yml
+++ b/.github/workflows/pam-ipmi.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 
diff --git a/.github/workflows/pq-all.yml b/.github/workflows/pq-all.yml
index 7805f91d87..c677c616fe 100644
--- a/.github/workflows/pq-all.yml
+++ b/.github/workflows/pq-all.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/pr-commit-check.yml b/.github/workflows/pr-commit-check.yml
index 78449b7c99..faa8b8541d 100644
--- a/.github/workflows/pr-commit-check.yml
+++ b/.github/workflows/pr-commit-check.yml
@@ -8,6 +8,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/psk.yml b/.github/workflows/psk.yml
index 22c7de77df..147f586c3f 100644
--- a/.github/workflows/psk.yml
+++ b/.github/workflows/psk.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/puf.yml b/.github/workflows/puf.yml
index 737688bee2..0b760728b3 100644
--- a/.github/workflows/puf.yml
+++ b/.github/workflows/puf.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index f43b1188a2..95d33be996 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/rng-tools.yml b/.github/workflows/rng-tools.yml
index 06fc6eb761..1027ab80fc 100644
--- a/.github/workflows/rng-tools.yml
+++ b/.github/workflows/rng-tools.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/rtl8735b.yml b/.github/workflows/rtl8735b.yml
index fe262749d1..2696cc29f7 100644
--- a/.github/workflows/rtl8735b.yml
+++ b/.github/workflows/rtl8735b.yml
@@ -15,6 +15,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/rust-wrapper.yml b/.github/workflows/rust-wrapper.yml
index 1b97237616..b95c21cfe8 100644
--- a/.github/workflows/rust-wrapper.yml
+++ b/.github/workflows/rust-wrapper.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/smallStackSize.yml b/.github/workflows/smallStackSize.yml
index fe07ad83ad..636b8165d8 100644
--- a/.github/workflows/smallStackSize.yml
+++ b/.github/workflows/smallStackSize.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/socat.yml b/.github/workflows/socat.yml
index 6b285653d0..2e26cf7f0d 100644
--- a/.github/workflows/socat.yml
+++ b/.github/workflows/socat.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/softhsm.yml b/.github/workflows/softhsm.yml
index 9d141a2b08..aeb60ce227 100644
--- a/.github/workflows/softhsm.yml
+++ b/.github/workflows/softhsm.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/sssd.yml b/.github/workflows/sssd.yml
index d3ba3667c6..90d647c111 100644
--- a/.github/workflows/sssd.yml
+++ b/.github/workflows/sssd.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/stunnel.yml b/.github/workflows/stunnel.yml
index 879bc1655c..56ab4f26e9 100644
--- a/.github/workflows/stunnel.yml
+++ b/.github/workflows/stunnel.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/symbol-prefixes.yml b/.github/workflows/symbol-prefixes.yml
index fd767ca009..214ba44734 100644
--- a/.github/workflows/symbol-prefixes.yml
+++ b/.github/workflows/symbol-prefixes.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/threadx.yml b/.github/workflows/threadx.yml
index aa44193af9..5b4beb62d3 100644
--- a/.github/workflows/threadx.yml
+++ b/.github/workflows/threadx.yml
@@ -13,6 +13,9 @@ on:
 env:
   NETXDUO_REF: v6.4.3_rel
 
+permissions:
+  contents: read
+
 jobs:
   build:
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
diff --git a/.github/workflows/trackmemory.yml b/.github/workflows/trackmemory.yml
index f30d93d5e2..e2cf5ddde1 100644
--- a/.github/workflows/trackmemory.yml
+++ b/.github/workflows/trackmemory.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/watcomc.yml b/.github/workflows/watcomc.yml
index 3fa6063239..af47d55223 100644
--- a/.github/workflows/watcomc.yml
+++ b/.github/workflows/watcomc.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/win-csharp-test.yml b/.github/workflows/win-csharp-test.yml
index 001ac0fd96..1ccdd82f02 100644
--- a/.github/workflows/win-csharp-test.yml
+++ b/.github/workflows/win-csharp-test.yml
@@ -7,6 +7,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     branches: [ '*' ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 41627a4343..aae86f13d0 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -23,6 +23,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   windows_arm64_build:
     name: Windows ARM64 Build Test
diff --git a/.github/workflows/wolfCrypt-Wconversion.yml b/.github/workflows/wolfCrypt-Wconversion.yml
index 6e608c5368..0002f3809c 100644
--- a/.github/workflows/wolfCrypt-Wconversion.yml
+++ b/.github/workflows/wolfCrypt-Wconversion.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/wolfboot-integration.yml b/.github/workflows/wolfboot-integration.yml
index 47b44fafae..8f4827f00c 100644
--- a/.github/workflows/wolfboot-integration.yml
+++ b/.github/workflows/wolfboot-integration.yml
@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   WOLFBOOT_REPO: https://github.com/wolfSSL/wolfBoot.git
   WOLFBOOT_BRANCH: master
diff --git a/.github/workflows/wolfsm.yml b/.github/workflows/wolfsm.yml
index 113e255a99..927a709f46 100644
--- a/.github/workflows/wolfsm.yml
+++ b/.github/workflows/wolfsm.yml
@@ -16,6 +16,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/xcode.yml b/.github/workflows/xcode.yml
index e5b0254c9d..e18cd2ea95 100644
--- a/.github/workflows/xcode.yml
+++ b/.github/workflows/xcode.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/zephyr-4.x.yml b/.github/workflows/zephyr-4.x.yml
index dd5543235a..757020a789 100644
--- a/.github/workflows/zephyr-4.x.yml
+++ b/.github/workflows/zephyr-4.x.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs:
diff --git a/.github/workflows/zephyr.yml b/.github/workflows/zephyr.yml
index f0bb0fc7de..c987502a84 100644
--- a/.github/workflows/zephyr.yml
+++ b/.github/workflows/zephyr.yml
@@ -11,6 +11,9 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
+permissions:
+  contents: read
 # END OF COMMON SECTION
 
 jobs: