diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 25583365e..de4b7c446 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -13,6 +13,9 @@ jobs:
     name: Fetch Cargo dependencies
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -64,6 +67,9 @@ jobs:
     needs: [fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -106,6 +112,9 @@ jobs:
     needs: [fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -148,6 +157,9 @@ jobs:
     needs: [rustfmt, clippy, fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     continue-on-error: "${{ matrix.toolchain == 'beta' || matrix.toolchain == 'nightly' }}"
 
     strategy:
@@ -200,6 +212,9 @@ jobs:
     needs: [rustfmt, clippy, fetch]
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2
@@ -266,6 +281,10 @@ jobs:
     env:
       IMAGE: ghcr.io/matrix-org/matrix-authentication-service
 
+    permissions:
+      packages: write
+      contents: read
+
     steps:
       - name: Checkout the code
         uses: actions/checkout@v2