diff --git a/.github/workflows/format-command.yml b/.github/workflows/format-command.yml
index 887588baf79..121be2cb329 100644
--- a/.github/workflows/format-command.yml
+++ b/.github/workflows/format-command.yml
@@ -8,11 +8,12 @@ on:
   repository_dispatch:
     types: [format-command]
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   format:
+    permissions:
+      contents: write # for Git to git push
     runs-on: ubuntu-latest
     steps:
       # Generate token from GenericMappingTools bot
diff --git a/.github/workflows/slash-command-dispatch.yml b/.github/workflows/slash-command-dispatch.yml
index f6ac62bab45..40ac1702fc7 100644
--- a/.github/workflows/slash-command-dispatch.yml
+++ b/.github/workflows/slash-command-dispatch.yml
@@ -10,11 +10,13 @@ on:
     # Add "edited" type for test purposes. Where possible, avoid using to prevent processing unnecessary events.
     # types: [created, edited]
 
-permissions:
-  issues: write
+permissions: {}
 
 jobs:
   slashCommandDispatch:
+    permissions:
+      contents: write # for executing the repository_dispatch event
+      pull-requests: write # for peter-evans/slash-command-dispatch to create PR reaction
     if: ${{ github.event.issue.pull_request }}
     runs-on: ubuntu-latest
     steps: