diff --git a/modules/openapi-generator/src/main/resources/python/github-workflow.mustache b/modules/openapi-generator/src/main/resources/python/github-workflow.mustache
index 78cc772b1728..5ca2c1d0099e 100644
--- a/modules/openapi-generator/src/main/resources/python/github-workflow.mustache
+++ b/modules/openapi-generator/src/main/resources/python/github-workflow.mustache
@@ -8,6 +8,9 @@ name: {{packageName}} Python package
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/.github/workflows/python.yml b/samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/.github/workflows/python.yml
index 90ad394f3d43..02a097ebbbf5 100644
--- a/samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/.github/workflows/python.yml
+++ b/samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/.github/workflows/python.yml
@@ -7,6 +7,9 @@ name: openapi_client Python package
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/samples/client/echo_api/python/.github/workflows/python.yml b/samples/client/echo_api/python/.github/workflows/python.yml
index 90ad394f3d43..02a097ebbbf5 100644
--- a/samples/client/echo_api/python/.github/workflows/python.yml
+++ b/samples/client/echo_api/python/.github/workflows/python.yml
@@ -7,6 +7,9 @@ name: openapi_client Python package
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/samples/openapi3/client/petstore/python-aiohttp/.github/workflows/python.yml b/samples/openapi3/client/petstore/python-aiohttp/.github/workflows/python.yml
index 84f17fbb35e7..06d03df77f1e 100644
--- a/samples/openapi3/client/petstore/python-aiohttp/.github/workflows/python.yml
+++ b/samples/openapi3/client/petstore/python-aiohttp/.github/workflows/python.yml
@@ -7,6 +7,9 @@ name: petstore_api Python package
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/samples/openapi3/client/petstore/python/.github/workflows/python.yml b/samples/openapi3/client/petstore/python/.github/workflows/python.yml
index 84f17fbb35e7..06d03df77f1e 100644
--- a/samples/openapi3/client/petstore/python/.github/workflows/python.yml
+++ b/samples/openapi3/client/petstore/python/.github/workflows/python.yml
@@ -7,6 +7,9 @@ name: petstore_api Python package
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build: