diff --git a/.github/workflows/build-healthchat-desktop.yaml b/.github/workflows/build-healthchat-desktop.yaml
index aafee90294..e162e2da0a 100644
--- a/.github/workflows/build-healthchat-desktop.yaml
+++ b/.github/workflows/build-healthchat-desktop.yaml
@@ -157,6 +157,8 @@ jobs:
     linux:
         name: Linux ${{ matrix.arch }}
         needs: prepare
+        permissions:
+            contents: read
         strategy:
             matrix:
                 arch: [amd64, arm64]
@@ -171,6 +173,8 @@ jobs:
     macos:
         name: macOS
         needs: prepare
+        permissions:
+            contents: read
         uses: ./.github/workflows/build_desktop_macos.yaml
         secrets: inherit # zizmor: ignore[secrets-inherit]
         with:
@@ -183,6 +187,8 @@ jobs:
     windows:
         name: Windows ${{ matrix.arch }}
         needs: prepare
+        permissions:
+            contents: read
         strategy:
             matrix:
                 arch: [x64, arm64]
diff --git a/.github/workflows/build_desktop_linux.yaml b/.github/workflows/build_desktop_linux.yaml
index 2fe4244a57..3d57dab607 100644
--- a/.github/workflows/build_desktop_linux.yaml
+++ b/.github/workflows/build_desktop_linux.yaml
@@ -76,6 +76,9 @@ jobs:
         # We build on native infrastructure as matrix-seshat fails to cross-compile properly
         # https://github.com/matrix-org/seshat/issues/135
         runs-on: ${{ inputs.runs-on || (inputs.arch == 'arm64' && 'ubuntu-22.04-arm' || 'ubuntu-22.04') }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         env:
             HAK_DOCKER_IMAGE: ghcr.io/element-hq/element-web/desktop-build-env:${{ case(github.event_name == 'push', inputs.ref || github.ref_name, github.event_name == 'release', 'staging', 'develop') }}
         steps:
diff --git a/.github/workflows/build_desktop_macos.yaml b/.github/workflows/build_desktop_macos.yaml
index 2e17834a4a..5043da5ffc 100644
--- a/.github/workflows/build_desktop_macos.yaml
+++ b/.github/workflows/build_desktop_macos.yaml
@@ -76,6 +76,9 @@ jobs:
         name: Build macOS Universal
         runs-on: macos-26 # M1
         environment: ${{ inputs.sign && 'Desktop Apple' || '' }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         steps:
             - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
               with:
diff --git a/.github/workflows/build_desktop_windows.yaml b/.github/workflows/build_desktop_windows.yaml
index 42789f7b6c..1b78b37f18 100644
--- a/.github/workflows/build_desktop_windows.yaml
+++ b/.github/workflows/build_desktop_windows.yaml
@@ -86,6 +86,9 @@ jobs:
         name: Build Windows ${{ inputs.arch }}
         runs-on: windows-2025
         environment: ${{ inputs.sign && 'Desktop eSigner' || '' }}
+        # contents:read so the checkout can clone the fork when it is a private/internal repo
+        permissions:
+            contents: read
         env:
             SIGNTOOL_PATH: "C:/Program Files (x86)/Windows Kits/10/bin/10.0.26100.0/x86/signtool.exe"
         steps: