diff --git a/.github/workflows/dev_pr.yml b/.github/workflows/dev_pr.yml
index 6621beab1002..5a7cff49a6fb 100644
--- a/.github/workflows/dev_pr.yml
+++ b/.github/workflows/dev_pr.yml
@@ -28,6 +28,12 @@ jobs:
   process:
     name: Process
     runs-on: ubuntu-latest
+    # only run for users whose permissions allow them to update PRs
+    # otherwise labeler is failing:
+    # https://github.com/apache/arrow-datafusion/issues/3743
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3