diff --git a/.github/workflows/api-breakage.yml b/.github/workflows/api-breakage.yml
index 40d3d6b..a14aafe 100644
--- a/.github/workflows/api-breakage.yml
+++ b/.github/workflows/api-breakage.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-apibreakage
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b693b4..f4edc3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-ci
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   macOS:
     runs-on: macos-26
@@ -44,7 +47,7 @@ jobs:
     timeout-minutes: 15
     strategy:
       matrix:
-        image: ["swift:6.0", "swift:6.1", "swift:6.2"]
+        image: ["swift:6.0", "swift:6.1", "swift:6.2", "swiftlang/swift:nightly-6.3-noble"]
     container:
       image: ${{ matrix.image }}
     steps:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index a85acea..7299855 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -3,6 +3,9 @@ name: Swift nightly build
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 4f05451..f265aa7 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-validate
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/verify-documentation.yml b/.github/workflows/verify-documentation.yml
index b388b7d..6035577 100644
--- a/.github/workflows/verify-documentation.yml
+++ b/.github/workflows/verify-documentation.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-verifydocs
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   linux:
     runs-on: ubuntu-latest