diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d07aecd3..1354c1ef3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Minimum permissions for all jobs
+permissions:
+  contents: read
+
 jobs:
   # ============================================================================
   # Backend Checks
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 020103e15..957e191ae 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -11,10 +11,17 @@ env:
   PYTHON_VERSION: '3.11'
   NODE_VERSION: '20'
 
+# Default permissions for all jobs
+permissions:
+  contents: read
+
 jobs:
   backend-audit:
     name: Backend Security Audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@v4
 
@@ -111,6 +118,9 @@ jobs:
   frontend-audit:
     name: Frontend Security Audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@v4