diff --git a/.github/workflows/build-mapscript-php.yml b/.github/workflows/build-mapscript-php.yml
index 3129935716..6efedb9abc 100644
--- a/.github/workflows/build-mapscript-php.yml
+++ b/.github/workflows/build-mapscript-php.yml
@@ -7,6 +7,13 @@ on:
     except:
       - /^(cherry-pick-)?backport-\d+-to-/
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/build-mapscript-python.yml b/.github/workflows/build-mapscript-python.yml
index bbc2cc4860..1a3c677953 100644
--- a/.github/workflows/build-mapscript-python.yml
+++ b/.github/workflows/build-mapscript-python.yml
@@ -7,6 +7,13 @@ on:
     except:
       - /^(cherry-pick-)?backport-\d+-to-/
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c113c76b25..f4a7dfb492 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,13 @@ name: Build
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/check-crlf.yml b/.github/workflows/check-crlf.yml
index 20dc50efd1..69faa8e65e 100644
--- a/.github/workflows/check-crlf.yml
+++ b/.github/workflows/check-crlf.yml
@@ -5,6 +5,13 @@ name: Check CRLF
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   Check-CRLF:
     name: verify that only LF linefeeds are used
@@ -17,4 +24,4 @@ jobs:
       - name: Use action to check for CRLF endings
         uses: erclu/check-crlf@v1.2.0
         with: # ignore directories containing *.pdf and *.tab
-          exclude: msautotest/misc/data/ /msautotest/renderers/expected/
\ No newline at end of file
+          exclude: msautotest/misc/data/ /msautotest/renderers/expected/
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 07da51244a..4ae8625bbb 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,5 +1,13 @@
 name: CIFuzz
 on: [pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/coverity-scan.yml b/.github/workflows/coverity-scan.yml
index edd44beafa..afda757c0c 100644
--- a/.github/workflows/coverity-scan.yml
+++ b/.github/workflows/coverity-scan.yml
@@ -9,6 +9,13 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   build:
diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index fdf1b9b7ad..b1757a35bc 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -2,6 +2,13 @@ name: cppcheck
 
 on: [push, pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
 
   cppcheck_2004:
diff --git a/.github/workflows/irc_notify.yml b/.github/workflows/irc_notify.yml
index d93f673efd..b89280d887 100644
--- a/.github/workflows/irc_notify.yml
+++ b/.github/workflows/irc_notify.yml
@@ -10,6 +10,13 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   irc_notify:
     runs-on: ubuntu-latest