diff --git a/.github/workflows/closed-issue-message.yml b/.github/workflows/closed-issue-message.yml
index 3340afb1..22bf2a7b 100644
--- a/.github/workflows/closed-issue-message.yml
+++ b/.github/workflows/closed-issue-message.yml
@@ -5,6 +5,8 @@ on:
 jobs:
     auto_comment:
         runs-on: ubuntu-latest
+        permissions:
+          issues: write
         steps:
         - uses: aws-actions/closed-issue-message@v1
           with:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 0cecba76..0a716dd4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,6 +10,8 @@ on:
 jobs:
   update-docs-branch:
     runs-on: ubuntu-20.04 # latest
+    permissions:
+      contents: write # allow push
     steps:
       - name: Checkout
         uses: actions/checkout@v3
diff --git a/.github/workflows/stale-issue.yml b/.github/workflows/stale-issue.yml
index 93920fa5..05f6ba70 100644
--- a/.github/workflows/stale-issue.yml
+++ b/.github/workflows/stale-issue.yml
@@ -9,6 +9,9 @@ jobs:
   cleanup:
     runs-on: ubuntu-latest
     name: Stale issue job
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
     - uses: aws-actions/stale-issue-cleanup@v3
       with: