diff --git a/.github/workflows/add-labels-main.yml b/.github/workflows/add-labels-main.yml
index 27c47a76..c5e7dbc8 100644
--- a/.github/workflows/add-labels-main.yml
+++ b/.github/workflows/add-labels-main.yml
@@ -7,6 +7,11 @@ on:
     types:
       - opened
 
+# Override read-only GITHUB_TOKEN default: label newly opened PRs.
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   add_labels:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 21b06b92..37a287cb 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -8,6 +8,11 @@ on:
       - labeled
       - closed
 
+# Override read-only GITHUB_TOKEN default: push backport branches and comment on PRs.
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   backport:
     if: |