diff --git a/.github/workflows/build_offline_docs.yml b/.github/workflows/build_offline_docs.yml
index 4928905ee..f35bbc078 100644
--- a/.github/workflows/build_offline_docs.yml
+++ b/.github/workflows/build_offline_docs.yml
@@ -18,6 +18,8 @@ jobs:
           - master
           - stable
           - 3.6
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/cherrypick.yml b/.github/workflows/cherrypick.yml
index c1d187783..72d0bdbfd 100644
--- a/.github/workflows/cherrypick.yml
+++ b/.github/workflows/cherrypick.yml
@@ -28,8 +28,11 @@ jobs:
       COMMIT_HASH: ${{ github.event.pull_request.commits > 1 && github.sha || github.event.pull_request.head.sha }}
       PR_NUMBER: ${{ github.event.number }}
 
-    steps:
+    permissions:
+      contents: write
+      pull-requests: write
 
+    steps:
     - name: Checkout
       uses: actions/checkout@v4
       with:
diff --git a/.github/workflows/sync_class_ref.yml b/.github/workflows/sync_class_ref.yml
index 7360d18b3..14cb90eac 100644
--- a/.github/workflows/sync_class_ref.yml
+++ b/.github/workflows/sync_class_ref.yml
@@ -22,6 +22,9 @@ jobs:
     runs-on: ubuntu-24.04
     env:
       engine_rev: 'master'
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout the documentation repository