diff --git a/.github/workflows/cherry-pick.yaml b/.github/workflows/cherry-pick.yaml
index 8654f9ca76..bfdc601538 100644
--- a/.github/workflows/cherry-pick.yaml
+++ b/.github/workflows/cherry-pick.yaml
@@ -22,11 +22,7 @@ on:
       - closed
       - labeled
 
-permissions:
-  contents: write
-  pull-requests: write
-  # Required to create the release-specific cherry-pick label if missing.
-  issues: write
+permissions: {}
 
 # Prevent duplicate runs for the same PR when both 'closed' and 'labeled'
 # fire in quick succession.
@@ -36,6 +32,11 @@ concurrency:
 jobs:
   cherry-pick:
     name: Cherry-pick to latest release
+    permissions:
+      contents: write
+      pull-requests: write
+      # Required to create the release-specific cherry-pick label if missing.
+      issues: write
     if: >
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'cherry-pick')
diff --git a/.github/workflows/pr-auto-assign.yaml b/.github/workflows/pr-auto-assign.yaml
index bdb7730d74..a910bc9600 100644
--- a/.github/workflows/pr-auto-assign.yaml
+++ b/.github/workflows/pr-auto-assign.yaml
@@ -7,11 +7,12 @@ on:
   pull_request_target:
     types: [opened]
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   assign-author:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/pr-cherry-pick-check.yaml b/.github/workflows/pr-cherry-pick-check.yaml
index db3a099aeb..dedc730d8a 100644
--- a/.github/workflows/pr-cherry-pick-check.yaml
+++ b/.github/workflows/pr-cherry-pick-check.yaml
@@ -9,11 +9,12 @@ on:
     branches:
       - "release/*"
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   check-cherry-pick:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/publish-mcp-registry.yaml b/.github/workflows/publish-mcp-registry.yaml
index ce203433ee..f88f9e51a0 100644
--- a/.github/workflows/publish-mcp-registry.yaml
+++ b/.github/workflows/publish-mcp-registry.yaml
@@ -15,6 +15,8 @@ on:
         default: false
         type: boolean
 
+permissions: {}
+
 jobs:
   publish-mcp:
     runs-on: ubuntu-latest
diff --git a/AGENTS.md b/AGENTS.md
index bf1ddbb7e7..4cd36c1e84 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -104,6 +104,11 @@ instructions focused on guardrails that agents should see immediately.
 - **Frontend**: Read [Frontend Development Guidelines](site/AGENTS.md)
   before changing anything under `site/`. Reuse shared UI primitives when
   possible and prefer Storybook stories for component and page testing.
+- **GitHub Actions permissions**: Follow least privilege as recommended by
+  OpenSSF Scorecard. Do not set write permissions at the workflow
+  (top) level. Default every workflow to `permissions: {}` at the top level
+  and grant only the specific permissions each job needs under
+  `jobs.<id>.permissions`.
 
 ## Quick Reference