diff --git a/.forgejo/workflows/auto-labeler.yml b/.forgejo/workflows/auto-labeler.yml
index 71b59eb19..af345b215 100644
--- a/.forgejo/workflows/auto-labeler.yml
+++ b/.forgejo/workflows/auto-labeler.yml
@@ -4,11 +4,6 @@ on:
   pull_request_target:
     types: [opened, reopened]
 
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
 jobs:
   auto-label:
     name: Apply labels based on changed files
diff --git a/.forgejo/workflows/build-nix.yml b/.forgejo/workflows/build-nix.yml
index ee16f0d25..2d203541c 100644
--- a/.forgejo/workflows/build-nix.yml
+++ b/.forgejo/workflows/build-nix.yml
@@ -54,8 +54,6 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - build
-    permissions:
-      contents: write
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Download binary artifacts
diff --git a/.forgejo/workflows/check-changelog.yml b/.forgejo/workflows/check-changelog.yml
index eb4ecb66a..c67fc9de2 100644
--- a/.forgejo/workflows/check-changelog.yml
+++ b/.forgejo/workflows/check-changelog.yml
@@ -4,11 +4,6 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
 
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
 jobs:
   check-changelog:
     name: Check changelog is added
diff --git a/.forgejo/workflows/prek-checks.yml b/.forgejo/workflows/prek-checks.yml
index 6c00a7e35..64f3f623e 100644
--- a/.forgejo/workflows/prek-checks.yml
+++ b/.forgejo/workflows/prek-checks.yml
@@ -7,10 +7,6 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pull-requests: read
-
 jobs:
   fast-checks:
     name: Pre-commit & Formatting
diff --git a/.forgejo/workflows/release-image.yml b/.forgejo/workflows/release-image.yml
index 6224c0f2f..78fee4223 100644
--- a/.forgejo/workflows/release-image.yml
+++ b/.forgejo/workflows/release-image.yml
@@ -27,12 +27,6 @@ env:
   BUILTIN_REGISTRY_ENABLED: "${{ ((vars.BUILTIN_REGISTRY_USER && secrets.BUILTIN_REGISTRY_PASSWORD) || (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false)) && 'true' || 'false' }}"
   IMAGE_PATH: forgejo.ellis.link/continuwuation/continuwuity
 
-permissions:
-  contents: write
-  packages: write
-  attestations: write
-  id-token: write
-
 jobs:
   build-release:
     name: "Build ${{ matrix.slug }} (release)"