diff --git a/.github/workflows/changed-packages.yml b/.github/workflows/changed-packages.yml
new file mode 100644
index 00000000000..7e91262c32e
--- /dev/null
+++ b/.github/workflows/changed-packages.yml
@@ -0,0 +1,44 @@
+name: Check which packages changed
+
+permissions: read-all
+
+on:
+  workflow_call:
+    outputs:
+      changes:
+        description: 'The packages that were changed for this PR'
+        value: ${{ jobs.check-changes.outputs.changes }}
+jobs:
+  check-changes:
+    name: Check which packages changed
+    runs-on: ubuntu-latest
+    outputs:
+      changes: ${{ steps.changes.outputs.changes }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3.3.0
+        with:
+          fetch-depth: 2
+      - name: Detect changed packages
+        uses: dorny/paths-filter@v2.11.1
+        id: changes
+        with:
+          filters: |
+            puppeteer:
+              - '.github/workflows/ci.yml'
+              - 'packages/puppeteer/**'
+              - 'packages/puppeteer-core/**'
+              - 'docker/**'
+              - 'test/**'
+              - 'test-d/**'
+              - 'tools/mochaRunner/**'
+            website:
+              - '.github/workflows/ci.yml'
+              - 'docs/**'
+              - 'website/**'
+            ng-schematics:
+              - '.github/workflows/ci.yml'
+              - 'packages/ng-schematics/**'
+            browsers:
+              - '.github/workflows/ci.yml'
+              - 'packages/browsers/**'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f645b0accfa..f9a3e5d7e6c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,38 +55,7 @@ jobs:
           rm $diff_file
 
   check-changes:
-    name: Check which packages changed
-    runs-on: ubuntu-latest
-    outputs:
-      changes: ${{ steps.changes.outputs.changes }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v3.3.0
-        with:
-          fetch-depth: 2
-      - name: Detect changed packages
-        uses: dorny/paths-filter@v2.11.1
-        id: changes
-        with:
-          filters: |
-            puppeteer:
-              - '.github/workflows/ci.yml'
-              - 'packages/puppeteer/**'
-              - 'packages/puppeteer-core/**'
-              - 'docker/**'
-              - 'test/**'
-              - 'test-d/**'
-              - 'tools/mochaRunner/**'
-            website:
-              - '.github/workflows/ci.yml'
-              - 'docs/**'
-              - 'website/**'
-            ng-schematics:
-              - '.github/workflows/ci.yml'
-              - 'packages/ng-schematics/**'
-            browsers:
-              - '.github/workflows/ci.yml'
-              - 'packages/browsers/**'
+    uses: ./.github/workflows/changed-packages.yml
 
   deploy-docs:
     needs: check-changes
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index 86806ea9fb3..048e4307f71 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -1,5 +1,7 @@
 name: Pre-release
 
+permissions: read-all
+
 on:
   push:
     branches:
@@ -7,28 +9,7 @@ on:
 
 jobs:
   check-changes:
-    name: Check which packages changed
-    runs-on: ubuntu-latest
-    outputs:
-      changes: ${{ steps.changes.outputs.changes }}
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v3.3.0
-        with:
-          fetch-depth: 2
-      - name: Detect changed packages
-        uses: dorny/paths-filter@v2.11.1
-        id: changes
-        with:
-          filters: |
-            puppeteer:
-              - '.github/workflows/ci.yml'
-              - 'packages/puppeteer/**'
-              - 'packages/puppeteer-core/**'
-              - 'docker/**'
-              - 'test/**'
-              - 'test-d/**'
-              - 'tools/mochaRunner/**'
+    uses: ./.github/workflows/changed-packages.yml
 
   pre-release:
     if: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2250314609a..8a7265cf31e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,7 @@
 name: Publish
 
+permissions: read-all
+
 on:
   workflow_dispatch:
   push: