diff --git a/.github/workflows/callable-test-core-build-process.yml b/.github/workflows/callable-test-core-build-process.yml
index faedb87bf566a..838b723a6a8a1 100644
--- a/.github/workflows/callable-test-core-build-process.yml
+++ b/.github/workflows/callable-test-core-build-process.yml
@@ -20,6 +20,11 @@ on:
 env:
   PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
 
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   # Verifies that installing npm dependencies and building WordPress works as expected.
   #
diff --git a/.github/workflows/callable-test-gutenberg-build-process.yml b/.github/workflows/callable-test-gutenberg-build-process.yml
index f009c2817ec34..14920d760f3dc 100644
--- a/.github/workflows/callable-test-gutenberg-build-process.yml
+++ b/.github/workflows/callable-test-gutenberg-build-process.yml
@@ -17,6 +17,11 @@ on:
         type: 'string'
         default: 'src'
 
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 env:
   GUTENBERG_DIRECTORY: ${{ inputs.directory == 'build' && 'build' || 'src' }}/wp-content/plugins/gutenberg
   PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
diff --git a/.github/workflows/phpunit-tests-run.yml b/.github/workflows/phpunit-tests-run.yml
index 871585d572d35..9d8e85857a4bc 100644
--- a/.github/workflows/phpunit-tests-run.yml
+++ b/.github/workflows/phpunit-tests-run.yml
@@ -45,6 +45,12 @@ on:
         required: false
         type: 'boolean'
         default: false
+
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 env:
   LOCAL_PHP: ${{ inputs.php }}-fpm
   LOCAL_DB_TYPE: ${{ inputs.db-type }}
diff --git a/.github/workflows/upgrade-testing-run.yml b/.github/workflows/upgrade-testing-run.yml
index b129818192e83..4c3d53b460ad2 100644
--- a/.github/workflows/upgrade-testing-run.yml
+++ b/.github/workflows/upgrade-testing-run.yml
@@ -37,6 +37,11 @@ on:
         type: 'string'
         default: '5.7'
 
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   # Runs upgrade tests on a build of WordPress.
   #