diff --git a/.github/workflows/next-deployment.yml b/.github/workflows/next-deployment.yml
index fc37c791..8c87e92a 100644
--- a/.github/workflows/next-deployment.yml
+++ b/.github/workflows/next-deployment.yml
@@ -15,7 +15,9 @@ jobs:
     outputs:
       spaUrl: ${{ steps.spa-deployment.outputs.url }}
     permissions:
+      contents: read
       packages: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
diff --git a/.github/workflows/preview-deployment.yml b/.github/workflows/preview-deployment.yml
index fb2edcd1..a5a042ab 100644
--- a/.github/workflows/preview-deployment.yml
+++ b/.github/workflows/preview-deployment.yml
@@ -61,7 +61,9 @@ jobs:
       (github.event_name == 'issue_comment' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/deploy-preview')) &&
       (needs.comment-handler.outputs.is-admin == 'true')
     permissions:
+      contents: read
       packages: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
         with: