diff --git a/.github/workflows/android_build.yml b/.github/workflows/android_build.yml
index 33f52d45fc55..65c131f20b77 100644
--- a/.github/workflows/android_build.yml
+++ b/.github/workflows/android_build.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/android_tests.yml b/.github/workflows/android_tests.yml
index f7f40d0a813e..e4a536b231e7 100644
--- a/.github/workflows/android_tests.yml
+++ b/.github/workflows/android_tests.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/asan.yml b/.github/workflows/asan.yml
index d5c9fbe8aec4..72b6e8134a59 100644
--- a/.github/workflows/asan.yml
+++ b/.github/workflows/asan.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/cc_tests.yml b/.github/workflows/cc_tests.yml
index 96f70a863851..1d3ea640bdca 100644
--- a/.github/workflows/cc_tests.yml
+++ b/.github/workflows/cc_tests.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/compile_time_options.yml b/.github/workflows/compile_time_options.yml
index f6a07d6e078b..c590bb3f994f 100644
--- a/.github/workflows/compile_time_options.yml
+++ b/.github/workflows/compile_time_options.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index d56dc22169b0..fe9e6fae5d02 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index cc05f86d6b84..1fa2afe86731 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e47981350723..936f281dd2ae 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 51a5971f2d0e..e6c650fb6220 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/ios_build.yml b/.github/workflows/ios_build.yml
index 708e578c3a84..57883c013fef 100644
--- a/.github/workflows/ios_build.yml
+++ b/.github/workflows/ios_build.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/ios_tests.yml b/.github/workflows/ios_tests.yml
index c2b141027d9f..2f9be87c84ca 100644
--- a/.github/workflows/ios_tests.yml
+++ b/.github/workflows/ios_tests.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 7d80b283e91a..8e1bbe104af1 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/release_validation.yml b/.github/workflows/release_validation.yml
index f5f03d84420a..0da7aa0abe15 100644
--- a/.github/workflows/release_validation.yml
+++ b/.github/workflows/release_validation.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true
diff --git a/.github/workflows/tsan.yml b/.github/workflows/tsan.yml
index 622a29f867d7..ba1325a7cbc4 100644
--- a/.github/workflows/tsan.yml
+++ b/.github/workflows/tsan.yml
@@ -4,8 +4,14 @@ on:
   push:
     branches:
     - main
+  pull_request_target:
+  # TODO(yannic): Remove when #26109 is merged and the required checks migrated
+  # to `pull_request_target`.
   pull_request:
 
+# TODO(yannic): Set to `permissions: {}` after migrating away from GitHub token for RE.
+permissions: read-all
+
 concurrency:
   group: ${{ github.head_ref-github.workflow || github.run_id }}
   cancel-in-progress: true