diff --git a/.github/workflows/gradle-check.yml b/.github/workflows/gradle-check.yml
index 5435da8419f5e..9567bcd63bc2e 100644
--- a/.github/workflows/gradle-check.yml
+++ b/.github/workflows/gradle-check.yml
@@ -8,8 +8,15 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 jobs:
   gradle-check:
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+      pull-requests: write # to create or update comment (peter-evans/create-or-update-comment)
+
     runs-on: ubuntu-latest
     timeout-minutes: 130
     steps:
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index ca05aee8be378..ac94f5ef5ec5e 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -2,6 +2,8 @@ name: Link Checker
 on:
   schedule:
     - cron:  '0 0 * * *'
+permissions:
+  contents: read # to fetch code (actions/checkout)
 jobs:
   linkchecker:
     if: github.repository == 'opensearch-project/OpenSearch'
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 42c2d21d106ce..d1b5e90484ec4 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -5,6 +5,7 @@ on:
     tags:
       - '*.*.*'
 
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28548021d8aa9..d504ea22ef64b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased 3.0]
 ### Added
+- Hardened token permissions in GitHub workflows ([#4587](https://github.com/opensearch-project/OpenSearch/pull/4587))
 - Support for HTTP/2 (server-side) ([#3847](https://github.com/opensearch-project/OpenSearch/pull/3847))
 - Add getter for path field in NestedQueryBuilder ([#4636](https://github.com/opensearch-project/OpenSearch/pull/4636))
 - Apply reproducible builds configuration for OpenSearch plugins through gradle plugin ([#4746](https://github.com/opensearch-project/OpenSearch/pull/4746))