diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
index f1314be..0600666 100644
--- a/.github/workflows/deploy-preview.yml
+++ b/.github/workflows/deploy-preview.yml
@@ -14,6 +14,10 @@ jobs:
     name: Deploy preview
     if: ${{ github.repository == 'dot013/.www-new' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      deployments: write
     strategy:
       matrix:
         node-version: [20]
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b8f07c9..26623b3 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,6 +10,10 @@ jobs:
     name: Deploy
     if: ${{ github.repository == 'dot013/.www-new' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      deployments: write
     strategy:
       matrix:
         node-version: [20]