diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 8d89d4a..d40e952 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -4,6 +4,8 @@ on:
     types: [opened]
 jobs:
   issue-triage:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
       - uses: github/issue-labeler@v3.4
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index c6b8539..5a05edb 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -11,6 +11,9 @@ on:
 jobs:
   label-sync:
     name: Label sync
+    permissions:
+      contents: read
+      issues: write
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NanoForge-dev'
     steps: