diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7b88c27b..dd633fed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -391,6 +391,9 @@ jobs:
 
   upload-to-r2:
     needs: [get-release, build-tauri]
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/upload-to-r2.yml
     with:
       tag: ${{ needs.get-release.outputs.release_tag }}
diff --git a/.github/workflows/retry-workflow.yml b/.github/workflows/retry-workflow.yml
index 0219289b..7e0dd24c 100644
--- a/.github/workflows/retry-workflow.yml
+++ b/.github/workflows/retry-workflow.yml
@@ -8,6 +8,8 @@ on:
 jobs:
   rerun:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: rerun ${{ inputs.run_id }}
         env:
diff --git a/.github/workflows/upload-to-r2.yml b/.github/workflows/upload-to-r2.yml
index 6b68c378..c462893d 100644
--- a/.github/workflows/upload-to-r2.yml
+++ b/.github/workflows/upload-to-r2.yml
@@ -17,6 +17,8 @@ on:
 jobs:
   upload-to-r2:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 3
     strategy:
       fail-fast: false
@@ -70,6 +72,8 @@ jobs:
     if: failure() && fromJSON(github.run_attempt) < 3
     needs: [upload-to-r2]
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - env:
           GH_REPO: ${{ github.repository }}