diff --git a/.github/workflows/pr-auto-fix.yaml b/.github/workflows/pr-auto-fix.yaml
index f61ee7b26ab..712eeb12f43 100644
--- a/.github/workflows/pr-auto-fix.yaml
+++ b/.github/workflows/pr-auto-fix.yaml
@@ -1,7 +1,13 @@
 name: PR AutoFix
 on: [push]
+permissions: {}
 jobs:
   PRAutoFix:
+    permissions:
+      actions: write # to cancel/stop running workflows (styfle/cancel-workflow-action)
+      contents: write # to create branch (peter-evans/create-pull-request)
+      pull-requests: write # to create a PR (peter-evans/create-pull-request)
+
     runs-on: ubuntu-latest
     steps:
       # Cache bazel build
diff --git a/.github/workflows/pr-auto-tag.yaml b/.github/workflows/pr-auto-tag.yaml
index 22041f6f1b7..dac7b2d438b 100644
--- a/.github/workflows/pr-auto-tag.yaml
+++ b/.github/workflows/pr-auto-tag.yaml
@@ -2,8 +2,15 @@ name: PR AutoTag
 on:
   pull_request_target:
     types: [opened, reopened, synchronized, edited]
+permissions:
+  contents: read # to determine modified files (actions/labeler)
+
 jobs:
   triage:
+    permissions:
+      contents: read # to determine modified files (actions/labeler)
+      pull-requests: write # to add labels to PRs (actions/labeler)
+
     runs-on: ubuntu-latest
     steps:
     - uses: actions/labeler@v3