diff --git a/.github/workflows/branch_release.yml b/.github/workflows/branch_release.yml
index b864e71..e0b4cfc 100644
--- a/.github/workflows/branch_release.yml
+++ b/.github/workflows/branch_release.yml
@@ -8,6 +8,10 @@ on:
     tags:
       - '*'
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   branch_release:
     if: github.event.created && github.event.sender.login == 'labkey-teamcity'
diff --git a/.github/workflows/merge_release.yml b/.github/workflows/merge_release.yml
index 440c9a3..f6d8d6e 100644
--- a/.github/workflows/merge_release.yml
+++ b/.github/workflows/merge_release.yml
@@ -8,6 +8,10 @@ on:
     types:
       - submitted
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   merge_release:
     if: >
diff --git a/.github/workflows/validate_pr.yml b/.github/workflows/validate_pr.yml
index b567d8a..82d9a7a 100644
--- a/.github/workflows/validate_pr.yml
+++ b/.github/workflows/validate_pr.yml
@@ -10,6 +10,9 @@ on:
       - reopened
       - ready_for_review
 
+permissions:
+  pull-requests: read
+
 jobs:
   validate_pr:
     if: github.event.pull_request.head.repo.owner.login == 'LabKey'