diff --git a/.github/workflows/pull-request-labeler.yml b/.github/workflows/pull-request-labeler.yml
index 64701f33721c..f5c318b43413 100644
--- a/.github/workflows/pull-request-labeler.yml
+++ b/.github/workflows/pull-request-labeler.yml
@@ -4,13 +4,13 @@ on:
 
 # Permissions needed for labelling Pull Requests automatically
 # https://docs.github.com/en/actions/security-guides/automatic-token-authentication
-permissions:
-   contents: read
-   pull-requests: write
 
 jobs:
 
   label_pull_request:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
     - uses: thomasjpfan/labeler@v2.5.1