diff --git a/.github/workflows/_build.yaml b/.github/workflows/_build.yaml
index 829730e..7ba4a60 100644
--- a/.github/workflows/_build.yaml
+++ b/.github/workflows/_build.yaml
@@ -8,7 +8,8 @@
 
 name: Build
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/_build_doc.yaml b/.github/workflows/_build_doc.yaml
index dd6d2b1..6b95fcb 100644
--- a/.github/workflows/_build_doc.yaml
+++ b/.github/workflows/_build_doc.yaml
@@ -7,7 +7,8 @@
 
 name: Build Doc
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/_codecov.yaml b/.github/workflows/_codecov.yaml
index f57f7cd..bbaf684 100644
--- a/.github/workflows/_codecov.yaml
+++ b/.github/workflows/_codecov.yaml
@@ -8,7 +8,8 @@
 
 name: CodeCov
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/_codeql.yaml b/.github/workflows/_codeql.yaml
index bfa8338..449f073 100644
--- a/.github/workflows/_codeql.yaml
+++ b/.github/workflows/_codeql.yaml
@@ -12,8 +12,6 @@
 
 name: CodeQL
 
-permissions: read-all
-
 on:
   workflow_call:
 
diff --git a/.github/workflows/_pre_commit.yaml b/.github/workflows/_pre_commit.yaml
index 97aa089..a054100 100644
--- a/.github/workflows/_pre_commit.yaml
+++ b/.github/workflows/_pre_commit.yaml
@@ -7,7 +7,8 @@
 
 name: Pre-Commit
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/_pypi_publish.yaml b/.github/workflows/_pypi_publish.yaml
index 5d03139..fb9a99e 100644
--- a/.github/workflows/_pypi_publish.yaml
+++ b/.github/workflows/_pypi_publish.yaml
@@ -9,7 +9,8 @@
 
 name: PyPI Publish
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/_test.yaml b/.github/workflows/_test.yaml
index a05412d..f29adfd 100644
--- a/.github/workflows/_test.yaml
+++ b/.github/workflows/_test.yaml
@@ -7,7 +7,8 @@
 
 name: Test Spot
 
-permissions: read-all
+permissions:
+  contents: read
 
 on:
   workflow_call:
diff --git a/.github/workflows/cicd.yaml b/.github/workflows/cicd.yaml
index 6519804..aa11d7b 100644
--- a/.github/workflows/cicd.yaml
+++ b/.github/workflows/cicd.yaml
@@ -7,8 +7,6 @@
 
 name: CI/CD
 
-permissions: read-all
-
 on:
   push:
     branches: