diff --git a/.github/workflows/docker_linuxes.yml b/.github/workflows/docker_linuxes.yml
index 38e1bac..0983dfd 100644
--- a/.github/workflows/docker_linuxes.yml
+++ b/.github/workflows/docker_linuxes.yml
@@ -1,5 +1,9 @@
 name: Docker-Linuxes
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 3fe07ee..c750178 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -1,5 +1,9 @@
 name: FreeBSD
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/mac_debug.yml b/.github/workflows/mac_debug.yml
index 18e21b2..e95473d 100644
--- a/.github/workflows/mac_debug.yml
+++ b/.github/workflows/mac_debug.yml
@@ -1,5 +1,9 @@
 name: macOS-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/mac_release.yml b/.github/workflows/mac_release.yml
index 52e99c8..de5626e 100644
--- a/.github/workflows/mac_release.yml
+++ b/.github/workflows/mac_release.yml
@@ -1,5 +1,9 @@
 name: macOS-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/mac_release_shared.yml b/.github/workflows/mac_release_shared.yml
index 57bdb20..9edb323 100644
--- a/.github/workflows/mac_release_shared.yml
+++ b/.github/workflows/mac_release_shared.yml
@@ -1,5 +1,9 @@
 name: macOS-Release-shared
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/mac_release_static.yml b/.github/workflows/mac_release_static.yml
index 6012ee4..98b297c 100644
--- a/.github/workflows/mac_release_static.yml
+++ b/.github/workflows/mac_release_static.yml
@@ -1,5 +1,9 @@
 name: macOS-Release-shared
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/ubuntu_address_sanitizer.yml b/.github/workflows/ubuntu_address_sanitizer.yml
index 8d7156a..5c6326d 100644
--- a/.github/workflows/ubuntu_address_sanitizer.yml
+++ b/.github/workflows/ubuntu_address_sanitizer.yml
@@ -1,5 +1,9 @@
 name: Ubuntu-AddressSanitizer
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
@@ -58,9 +62,6 @@ jobs:
       # See https://cmake.org/cmake/help/latest/manual/ctest.1.html for more detail
       run: ctest -V --output-on-failure -C ${{env.BUILD_TYPE}} 
   
-  
-  
-  
   openexr3:
     # The CMake configure and build commands are platform agnostic and should work equally well on Windows or Mac.
     # You can convert this to a matrix build if you need cross-platform coverage.
diff --git a/.github/workflows/ubuntu_debug.yml b/.github/workflows/ubuntu_debug.yml
index 63b740c..0bfd6e9 100644
--- a/.github/workflows/ubuntu_debug.yml
+++ b/.github/workflows/ubuntu_debug.yml
@@ -1,5 +1,9 @@
 name: Ubuntu-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/ubuntu_no_libtiff.yml b/.github/workflows/ubuntu_no_libtiff.yml
index b28449c..5f0b849 100644
--- a/.github/workflows/ubuntu_no_libtiff.yml
+++ b/.github/workflows/ubuntu_no_libtiff.yml
@@ -1,5 +1,9 @@
 name: Ubuntu-No LibTIFF
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/ubuntu_release.yml b/.github/workflows/ubuntu_release.yml
index 7e52610..cfb649c 100644
--- a/.github/workflows/ubuntu_release.yml
+++ b/.github/workflows/ubuntu_release.yml
@@ -1,5 +1,9 @@
 name: Ubuntu-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/windows_debug.yml b/.github/workflows/windows_debug.yml
index 998a17e..c73d850 100644
--- a/.github/workflows/windows_debug.yml
+++ b/.github/workflows/windows_debug.yml
@@ -1,5 +1,9 @@
 name: Windows-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/windows_release.yml b/.github/workflows/windows_release.yml
index a5a9e1e..bb08678 100644
--- a/.github/workflows/windows_release.yml
+++ b/.github/workflows/windows_release.yml
@@ -1,5 +1,9 @@
 name: Windows-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/windows_vcpkg_debug.yml b/.github/workflows/windows_vcpkg_debug.yml
index 6f54ade..8665fb6 100644
--- a/.github/workflows/windows_vcpkg_debug.yml
+++ b/.github/workflows/windows_vcpkg_debug.yml
@@ -1,5 +1,9 @@
 name: Windows-vcpkg-Debug
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore:
diff --git a/.github/workflows/windows_vcpkg_release.yml b/.github/workflows/windows_vcpkg_release.yml
index a4dc50d..ef258c0 100644
--- a/.github/workflows/windows_vcpkg_release.yml
+++ b/.github/workflows/windows_vcpkg_release.yml
@@ -1,5 +1,9 @@
 name: Windows-vcpkg-Release
 
+permissions:
+  contents: read
+  pull-requests: write
+
 on:
   push:
     paths-ignore: