diff --git a/.github/workflows/docker-publish-multiarch-dev.yml b/.github/workflows/docker-publish-multiarch-dev.yml
index 8561210..d555f5c 100644
--- a/.github/workflows/docker-publish-multiarch-dev.yml
+++ b/.github/workflows/docker-publish-multiarch-dev.yml
@@ -1,10 +1,13 @@
 name: Docker Publish Dev Multiarch
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   push:
-    branches: master
+    branches:
+      - master
 
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/docker-publish-multiarch-release-custom.yml b/.github/workflows/docker-publish-multiarch-release-custom.yml
index 9809321..abd73c6 100644
--- a/.github/workflows/docker-publish-multiarch-release-custom.yml
+++ b/.github/workflows/docker-publish-multiarch-release-custom.yml
@@ -1,13 +1,15 @@
 name: Docker Publish Custom Release Multiarch
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
     inputs:
       tagname:
         description: 'Tag name to be built'
         required: true
 
 
+permissions:
+  contents: read
 
 jobs:
   build:
diff --git a/.github/workflows/docker-publish-multiarch-release.yml b/.github/workflows/docker-publish-multiarch-release.yml
index 18dc2b3..23c21fe 100644
--- a/.github/workflows/docker-publish-multiarch-release.yml
+++ b/.github/workflows/docker-publish-multiarch-release.yml
@@ -1,11 +1,14 @@
 name: Docker Publish Release Multiarch
 
 on:
-  workflow_dispatch:
+  workflow_dispatch: {}
   release:
     types: [released]
 
 
+permissions:
+  contents: read
+
 
 jobs:
   build:
diff --git a/.github/workflows/test-code.yml b/.github/workflows/test-code.yml
index 62e0639..5be7267 100644
--- a/.github/workflows/test-code.yml
+++ b/.github/workflows/test-code.yml
@@ -1,6 +1,8 @@
 name: Compile and run unit tests
 on: [workflow_dispatch, push, pull_request]
 
+permissions:
+  contents: read
 
 jobs:
   build: