diff --git a/.github/workflows/build-historical.yml b/.github/workflows/build-historical.yml
index 1d916e90783..45be3b62b48 100644
--- a/.github/workflows/build-historical.yml
+++ b/.github/workflows/build-historical.yml
@@ -1,7 +1,7 @@
 name: Build Historical
 
 permissions:
-  contents: write
+  contents: read
 
 on:
   workflow_dispatch:
@@ -215,6 +215,8 @@ jobs:
     needs: [prepare, build]
     if: ${{ github.event.inputs.create_release == 'true' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Download Generals Artifact
         if: ${{ github.event.inputs.game == 'Generals' || github.event.inputs.game == 'Both' }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5534a95ad29..b300a469c7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,7 +93,7 @@ jobs:
             tools: true
             extras: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "Generals"
       preset: ${{ matrix.preset }}
@@ -125,7 +125,7 @@ jobs:
             tools: true
             extras: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "GeneralsMD"
       preset: ${{ matrix.preset }}
@@ -163,7 +163,7 @@ jobs:
             tools: true
             extras: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "GeneralsMD"
       preset: ${{ matrix.preset }}
@@ -176,13 +176,15 @@ jobs:
     name: Replay Check GeneralsMD${{ matrix.preset && '' }}
     needs: build-generalsmd-vc6
     if: ${{ github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.generalsmd == 'true' || needs.detect-changes.outputs.shared == 'true' }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         include:
           - preset: "vc6+t+e"
           - preset: "vc6-releaselog+t+e" # optimized build with logging and crashing enabled should be compatible, so we test that here.
       fail-fast: false
-    uses: ./.github/workflows/check-replays.yml
+    uses: ./.github/workflows/reusable-check-replays.yml
     with:
       game: "GeneralsMD"
       userdata: "GeneralsReplays/GeneralsZH/1.04"
diff --git a/.github/workflows/build-toolchain.yml b/.github/workflows/reusable-build-toolchain.yml
similarity index 97%
rename from .github/workflows/build-toolchain.yml
rename to .github/workflows/reusable-build-toolchain.yml
index 55441827fb7..e61e7f93624 100644
--- a/.github/workflows/build-toolchain.yml
+++ b/.github/workflows/reusable-build-toolchain.yml
@@ -1,6 +1,9 @@
 name: Build Toolchain
 
-# No permissions here - callers grant contents: read, and packages: write if using vcpkg.
+# WARNING: Do not declare permissions in this reusable workflow.
+# Declare the required permissions in each calling job:
+#   contents: read - required for all builds.
+#   packages: write - required for vcpkg binary-cache uploads only.
 
 on:
   workflow_call:
diff --git a/.github/workflows/check-replays.yml b/.github/workflows/reusable-check-replays.yml
similarity index 98%
rename from .github/workflows/check-replays.yml
rename to .github/workflows/reusable-check-replays.yml
index 5f27c600bef..4039246073f 100644
--- a/.github/workflows/check-replays.yml
+++ b/.github/workflows/reusable-check-replays.yml
@@ -1,8 +1,8 @@
 name: Check Replays
 
-permissions:
-  contents: read
-  pull-requests: write
+# WARNING: Do not declare permissions in this reusable workflow.
+# Declare the required permissions in each calling job:
+#   contents: read - required for replay checks.
 
 on:
   workflow_call:
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index 52f7bdb8be2..97b0ff34d92 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -97,7 +97,7 @@ jobs:
             extras: false
             release: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "Generals"
       preset: ${{ matrix.preset }}
@@ -118,7 +118,7 @@ jobs:
             extras: false
             release: true
       fail-fast: false
-    uses: ./.github/workflows/build-toolchain.yml
+    uses: ./.github/workflows/reusable-build-toolchain.yml
     with:
       game: "GeneralsMD"
       preset: ${{ matrix.preset }}