diff --git a/.github/workflows/label-feature.yml b/.github/workflows/label-feature.yml
index 96ac8c1..d13cf87 100644
--- a/.github/workflows/label-feature.yml
+++ b/.github/workflows/label-feature.yml
@@ -5,6 +5,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
     - name: Close Issue
diff --git a/.github/workflows/label-support.yml b/.github/workflows/label-support.yml
index c6f2aa4..ea0f240 100644
--- a/.github/workflows/label-support.yml
+++ b/.github/workflows/label-support.yml
@@ -5,6 +5,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
     - name: Close Issue
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index c116b93..217078a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   stale:
 
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
 
     steps:
diff --git a/.github/workflows/sync_ghes.yaml b/.github/workflows/sync_ghes.yaml
index a3c298a..946218f 100644
--- a/.github/workflows/sync_ghes.yaml
+++ b/.github/workflows/sync_ghes.yaml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   sync:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
diff --git a/.github/workflows/validate-data.yaml b/.github/workflows/validate-data.yaml
index 745bc25..7d5c1ee 100644
--- a/.github/workflows/validate-data.yaml
+++ b/.github/workflows/validate-data.yaml
@@ -6,6 +6,8 @@ on:
 
 jobs:
   validate-data:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2