diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml
index 6a9c4e00ba..9b6a797702 100644
--- a/.github/workflows/coverity-scan.yml
+++ b/.github/workflows/coverity-scan.yml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0 0 * * 1,3,5'
 
+permissions:
+  contents: read
+
 jobs:
   scan:
     if: github.repository == 'zeek/zeek'
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 738cbf727e..979b6938ab 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -18,6 +18,9 @@ env:
   IMAGE_FILE: /tmp/zeek-image.tar
   IMAGE_PATH: /tmp
 
+permissions:
+  contents: read
+
 jobs:
   docker-build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/generate-docs.yml b/.github/workflows/generate-docs.yml
index 8ddf861401..da02c79f34 100644
--- a/.github/workflows/generate-docs.yml
+++ b/.github/workflows/generate-docs.yml
@@ -9,8 +9,13 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   generate:
+    permissions:
+      contents: write  # for Git to git push
     if: github.repository == 'zeek/zeek'
     runs-on: ubuntu-latest
 
diff --git a/CHANGES b/CHANGES
index 8791f14094..19af77236d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,19 @@
+5.1.0-dev.27 | 2022-06-14 11:30:28 -0700
+
+  * chore: Set permissions for GitHub actions (naveen)
+
+     Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.
+
+    - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
+
+    https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+
+    https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+
+    [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
+
+    Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
+
 5.1.0-dev.25 | 2022-06-14 10:07:32 -0700
 
   * chore: Included githubactions in the dependabot config (naveen)
diff --git a/VERSION b/VERSION
index 3c6f70da7d..5d509bd7c8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.1.0-dev.25
+5.1.0-dev.27