diff --git a/.github/workflows/cleanup_caches.yml b/.github/workflows/cleanup_caches.yml
index 9a152727a5..a2039aabb8 100644
--- a/.github/workflows/cleanup_caches.yml
+++ b/.github/workflows/cleanup_caches.yml
@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {} # uses own token below
+
 jobs:
   cache:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 0e3e78c4e0..828d4e9443 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -9,6 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {} # uses own token below
+
 jobs:
   pr_comment:
     if: github.event.workflow_run.event == 'pull_request' &&
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index d3c71fc1c5..76fa590537 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -1,4 +1,5 @@
 name: Pull Request Fuzzing
+
 on:
   pull_request:
     branches: [master]
@@ -12,10 +13,13 @@ on:
         - 'Copyright'
         - 'README.md'
         - 'RELEASE_NOTES'
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+
 permissions: {}
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest