diff --git a/.github/workflows/cleanup_caches.yml b/.github/workflows/cleanup_caches.yml
index a2039aabb8..1b324ddf5a 100644
--- a/.github/workflows/cleanup_caches.yml
+++ b/.github/workflows/cleanup_caches.yml
@@ -9,7 +9,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-permissions: {} # uses own token below
+permissions:
+  actions: write
 
 jobs:
   cache:
diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 828d4e9443..ab24475a1a 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -9,7 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-permissions: {} # uses own token below
+permissions:
+  actions: read
+  contents: write
 
 jobs:
   pr_comment: