diff --git a/.github/workflows/diagram.yml b/.github/workflows/diagram.yml
index d31937277..2c6c7d70f 100644
--- a/.github/workflows/diagram.yml
+++ b/.github/workflows/diagram.yml
@@ -20,6 +20,9 @@ jobs:
   check-diagram:
     name: Update the codebase structure diagram
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # for technote-space/create-pr-action to push code
+      pull-requests: write  # for technote-space/create-pr-action to create a PR
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # refs/tags/v4.2.0
       - name: Update diagram
diff --git a/.github/workflows/distros.yml b/.github/workflows/distros.yml
index 8cf016f2b..74a5adb30 100644
--- a/.github/workflows/distros.yml
+++ b/.github/workflows/distros.yml
@@ -17,6 +17,9 @@ permissions: read-all
 jobs:
   check-versions:
     name: Check for latest Vagrant box versions
+    permissions:
+      contents: write  # for technote-space/create-pr-action to push code
+      pull-requests: write  # for technote-space/create-pr-action to create a PR
     runs-on: macos-12
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # refs/tags/v4.2.0
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 2631ffda4..d708d4b30 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -17,6 +17,9 @@ permissions: read-all
 jobs:
   check-versions:
     name: Update python requirements files
+    permissions:
+      contents: write  # for technote-space/create-pr-action to push code
+      pull-requests: write  # for technote-space/create-pr-action to create a PR
     strategy:
       max-parallel: 1
       fail-fast: false
@@ -58,6 +61,9 @@ jobs:
           PR_TITLE: "chore: update versions"
   check-dictionary:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # for technote-space/create-pr-action to push code
+      pull-requests: write  # for technote-space/create-pr-action to create a PR
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # refs/tags/v4.2.0
       - uses: technote-space/create-pr-action@91114507cf92349bec0a9a501c2edf1635427bc5 # refs/tags/v2.1.4
@@ -83,6 +89,9 @@ jobs:
           PR_TITLE: "chore: update dictionary"
   check-github-actions:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # for technote-space/create-pr-action to push code
+      pull-requests: write  # for technote-space/create-pr-action to create a PR
     steps:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # refs/tags/v4.2.0
       - uses: technote-space/create-pr-action@91114507cf92349bec0a9a501c2edf1635427bc5 # refs/tags/v2.1.4