diff --git a/.github/workflows/issue.yaml b/.github/workflows/issue.yaml
index 26e394fd87..0729912c9d 100644
--- a/.github/workflows/issue.yaml
+++ b/.github/workflows/issue.yaml
@@ -3,8 +3,14 @@ on:
   issues:
     types: [opened]
 
+permissions:  
+  contents: read
+
 jobs:
   sync:
+    permissions:
+      contents: read  # for github/issue-labeler to get repo contents
+      issues: write  # for github/issue-labeler to create or remove labels
     runs-on: ubuntu-latest
 
     if: github.repository == 'backstage/backstage'