diff --git a/docs/integrations/github/locations.md b/docs/integrations/github/locations.md
index 330b03eab9..3395c61117 100644
--- a/docs/integrations/github/locations.md
+++ b/docs/integrations/github/locations.md
@@ -57,6 +57,22 @@ public GitHub, for which we can infer them). The `apiBaseUrl` will always be
 preferred over the other if a `token` is given, otherwise `rawBaseUrl` will be
 preferred.
 
+### Token scopes
+
+When creating a personal access token on GitHub, you must select scopes to
+define the level of access for the token. The scopes required vary depending on
+your use of the integration:
+
+- Reading software components:
+  - `repo`
+- Reading organization data:
+  - `read:org`
+  - `read:user`
+  - `user:email`
+- Publishing software templates:
+  - `repo`
+  - `workflow` (if templates include GitHub workflows)
+
 ## Authentication with GitHub Apps
 
 Alternatively, Backstage can use GitHub Apps for backend authentication. This
diff --git a/docs/plugins/github-apps.md b/docs/plugins/github-apps.md
index 1be1502b6b..434c9a4882 100644
--- a/docs/plugins/github-apps.md
+++ b/docs/plugins/github-apps.md
@@ -109,11 +109,21 @@ privateKey: |
 This will result in backstage preventing the use of any installation that is not
 within the allow list.
 
-### Permissions for pull requests
+### App permissions
 
-These are the minimum permissions required for creating a pull request with
-Backstage software templates:
+When creating a GitHub App, you must select permissions to define the level of
+access for the app. The permissions required vary depending on your use of the
+integration:
 
-- Read and Write permissions for `Contents`.
-- Read and write permissions for `Pull Requests` and `Issues`.
-- Read permissions on `Metadata`.
+- Reading software components:
+  - `Contents`: `Read-only`
+- Reading organization data:
+  - `Members`: `Read-only`
+- Publishing software templates:
+
+  - `Administration`: `Read & write` (for creating repositories)
+  - `Contents`: `Read & write`
+  - `Metadata`: `Read-only`
+  - `Pull requests`: `Read & write`
+  - `Issues`: `Read & write`
+  - `Workflows`: `Read & write` (if templates include GitHub workflows)