diff --git a/.github/workflows/sync_dependabot-changesets.yml b/.github/workflows/sync_dependabot-changesets.yml
index 2b1dd1098f..805ac462ee 100644
--- a/.github/workflows/sync_dependabot-changesets.yml
+++ b/.github/workflows/sync_dependabot-changesets.yml
@@ -5,6 +5,10 @@ on:
       - '.github/workflows/sync_dependabot-changesets.yml'
       - '**/yarn.lock'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sync_pull-requests-trigger.yml b/.github/workflows/sync_pull-requests-trigger.yml
index fe87517bd1..906cb45679 100644
--- a/.github/workflows/sync_pull-requests-trigger.yml
+++ b/.github/workflows/sync_pull-requests-trigger.yml
@@ -16,6 +16,11 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  actions: none
+  contents: none
+  pull-requests: none
+
 jobs:
   trigger:
     if: >
diff --git a/.github/workflows/sync_renovate-changesets.yml b/.github/workflows/sync_renovate-changesets.yml
index 04495e606b..65312b6f64 100644
--- a/.github/workflows/sync_renovate-changesets.yml
+++ b/.github/workflows/sync_renovate-changesets.yml
@@ -5,6 +5,10 @@ on:
       - '.github/workflows/sync_renovate-changesets.yml'
       - '**/yarn.lock'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-latest