diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml
index 377549962c..f768e7d5cc 100644
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -21,10 +21,16 @@ name: Pull Requests
 jobs:
   build-test-lint:
     name: Build, Test, and Lint
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-test-lint.yaml
     secrets: inherit
   espresso-test:
     name: Espresso Test
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/espresso.yaml
     secrets: inherit
     needs: