diff --git a/inst/touchstone-comment.yaml b/inst/touchstone-comment.yaml
index aa3d40d..0ef9c20 100644
--- a/inst/touchstone-comment.yaml
+++ b/inst/touchstone-comment.yaml
@@ -10,6 +10,11 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+  statuses: write
+  pull-requests: write
+
 jobs:
   upload:
     runs-on: ubuntu-latest
diff --git a/inst/touchstone-receive.yaml b/inst/touchstone-receive.yaml
index 83ea270..dd22e58 100644
--- a/inst/touchstone-receive.yaml
+++ b/inst/touchstone-receive.yaml
@@ -6,6 +6,9 @@ concurrency:
 
 on: #- trigger
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest #- ward
diff --git a/tests/testthat/_snaps/use/receive_all.yml b/tests/testthat/_snaps/use/receive_all.yml
index ea2360b..59f37be 100644
--- a/tests/testthat/_snaps/use/receive_all.yml
+++ b/tests/testthat/_snaps/use/receive_all.yml
@@ -8,6 +8,9 @@ on:
   issue_comment:
     types: ['created', 'edited']
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest 
diff --git a/tests/testthat/_snaps/use/receive_command.yml b/tests/testthat/_snaps/use/receive_command.yml
index 8ef7357..736579e 100644
--- a/tests/testthat/_snaps/use/receive_command.yml
+++ b/tests/testthat/_snaps/use/receive_command.yml
@@ -8,6 +8,9 @@ on:
   issue_comment:
     types: ['created', 'edited']
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest 
diff --git a/tests/testthat/_snaps/use/receive_default.yml b/tests/testthat/_snaps/use/receive_default.yml
index 24b2f6a..8deb723 100644
--- a/tests/testthat/_snaps/use/receive_default.yml
+++ b/tests/testthat/_snaps/use/receive_default.yml
@@ -7,6 +7,9 @@ concurrency:
 on: 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest 
diff --git a/tests/testthat/_snaps/use/receive_limit.yml b/tests/testthat/_snaps/use/receive_limit.yml
index a01c2b7..bf9e340 100644
--- a/tests/testthat/_snaps/use/receive_limit.yml
+++ b/tests/testthat/_snaps/use/receive_limit.yml
@@ -7,6 +7,9 @@ concurrency:
 on: 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   prepare:
     runs-on: ubuntu-latest