diff --git a/.github/workflows/ghcr_cleanup.yml b/.github/workflows/ghcr_cleanup.yml
index 1e7075b3..ccb296e1 100644
--- a/.github/workflows/ghcr_cleanup.yml
+++ b/.github/workflows/ghcr_cleanup.yml
@@ -3,6 +3,7 @@ on:
 
 name: GHCR cleanup
 
+permissions: {}
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/update_frontend.yml b/.github/workflows/update_frontend.yml
index 1382d386..45131836 100644
--- a/.github/workflows/update_frontend.yml
+++ b/.github/workflows/update_frontend.yml
@@ -3,8 +3,13 @@ on:
   repository_dispatch:
     types: update_frontend
 
+permissions: {}
 jobs:
   update_frontend:
+    permissions:
+      contents: write  #  to create branch (peter-evans/create-pull-request)
+      pull-requests: write  #  to create a PR (peter-evans/create-pull-request)
+
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
diff --git a/.github/workflows/update_zh.yml b/.github/workflows/update_zh.yml
index 92aaa05e..bba3ec2a 100644
--- a/.github/workflows/update_zh.yml
+++ b/.github/workflows/update_zh.yml
@@ -3,8 +3,13 @@ on:
   repository_dispatch:
     types: update_zh
 
+permissions: {}
 jobs:
   update_zh:
+    permissions:
+      contents: write  #  to create branch (peter-evans/create-pull-request)
+      pull-requests: write  #  to create a PR (peter-evans/create-pull-request)
+
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
diff --git a/.github/workflows/update_zhc.yml b/.github/workflows/update_zhc.yml
index 7df5e88c..a75cb1f7 100644
--- a/.github/workflows/update_zhc.yml
+++ b/.github/workflows/update_zhc.yml
@@ -3,8 +3,13 @@ on:
   repository_dispatch:
     types: update_zhc
 
+permissions: {}
 jobs:
   update_zhc:
+    permissions:
+      contents: write  #  to create branch (peter-evans/create-pull-request)
+      pull-requests: write  #  to create a PR (peter-evans/create-pull-request)
+
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3