diff --git a/.github/workflows/angular.yml b/.github/workflows/angular.yml
index cba7835f4..886e18a91 100644
--- a/.github/workflows/angular.yml
+++ b/.github/workflows/angular.yml
@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/comment-icon-preview.yml b/.github/workflows/comment-icon-preview.yml
index 91a72c376..f476a250a 100644
--- a/.github/workflows/comment-icon-preview.yml
+++ b/.github/workflows/comment-icon-preview.yml
@@ -6,6 +6,14 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+  # Download the pr_number artifact from the triggering run.
+  actions: read
+  # Create or update the icon preview comment on the PR.
+  issues: write
+  pull-requests: write
+
 jobs:
   upload:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/icons.yml b/.github/workflows/icons.yml
index ac382be5e..538fe1339 100644
--- a/.github/workflows/icons.yml
+++ b/.github/workflows/icons.yml
@@ -9,6 +9,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint-code.yml b/.github/workflows/lint-code.yml
index ce7f23c0c..edb2915cb 100644
--- a/.github/workflows/lint-code.yml
+++ b/.github/workflows/lint-code.yml
@@ -3,6 +3,9 @@ name: Linting PR code
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint-code:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml
index 32af252d4..0be3ac318 100644
--- a/.github/workflows/lint-pr-title.yml
+++ b/.github/workflows/lint-pr-title.yml
@@ -7,6 +7,10 @@ on:
       - edited
       - reopened
 
+permissions:
+  # The semantic PR action only reads the pull request title.
+  pull-requests: read
+
 jobs:
   lint-pr-title:
     name: PR Title Lint
diff --git a/.github/workflows/lucide-astro.yml b/.github/workflows/lucide-astro.yml
index d2a3ad6f6..bd27e26e5 100644
--- a/.github/workflows/lucide-astro.yml
+++ b/.github/workflows/lucide-astro.yml
@@ -11,6 +11,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-font.yml b/.github/workflows/lucide-font.yml
index 490d07883..d6358a774 100644
--- a/.github/workflows/lucide-font.yml
+++ b/.github/workflows/lucide-font.yml
@@ -9,6 +9,9 @@ on:
       - tools/build-font/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-font:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-preact.yml b/.github/workflows/lucide-preact.yml
index 43d58256f..a44092cd6 100644
--- a/.github/workflows/lucide-preact.yml
+++ b/.github/workflows/lucide-preact.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-preact:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-react-native.yml b/.github/workflows/lucide-react-native.yml
index 3db77b624..1430dffb6 100644
--- a/.github/workflows/lucide-react-native.yml
+++ b/.github/workflows/lucide-react-native.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-react.yml b/.github/workflows/lucide-react.yml
index ed89e1a36..165c2c3c8 100644
--- a/.github/workflows/lucide-react.yml
+++ b/.github/workflows/lucide-react.yml
@@ -13,6 +13,9 @@ on:
       - scripts/generateNextJSAliases.mjs
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-shared.yml b/.github/workflows/lucide-shared.yml
index 9a07f4ee0..2538582db 100644
--- a/.github/workflows/lucide-shared.yml
+++ b/.github/workflows/lucide-shared.yml
@@ -9,6 +9,9 @@ on:
       - packages/shared/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-solid.yml b/.github/workflows/lucide-solid.yml
index b31cf0486..5c1d99879 100644
--- a/.github/workflows/lucide-solid.yml
+++ b/.github/workflows/lucide-solid.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-static.yml b/.github/workflows/lucide-static.yml
index 224491d82..3ae78b031 100644
--- a/.github/workflows/lucide-static.yml
+++ b/.github/workflows/lucide-static.yml
@@ -7,6 +7,9 @@ on:
       - tools/build-icons/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   lucide-static:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-svelte-5.yml b/.github/workflows/lucide-svelte-5.yml
index 7e828c9d9..c82888e05 100644
--- a/.github/workflows/lucide-svelte-5.yml
+++ b/.github/workflows/lucide-svelte-5.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide-vue.yml b/.github/workflows/lucide-vue.yml
index a80cddf18..a998ffd1a 100644
--- a/.github/workflows/lucide-vue.yml
+++ b/.github/workflows/lucide-vue.yml
@@ -12,6 +12,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lucide.yml b/.github/workflows/lucide.yml
index 91ab79166..3ac44fff1 100644
--- a/.github/workflows/lucide.yml
+++ b/.github/workflows/lucide.yml
@@ -11,6 +11,9 @@ on:
       - tools/rollup-plugins/**
       - pnpm-lock.yaml
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest