diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 11635aae2e..1dc7f16a60 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,6 +78,8 @@ jobs:
         with:
           client-id: ${{ secrets.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
+          repositories: ${{ github.repository }}
+          permission-contents: write
 
       - name: Create GitHub release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
diff --git a/.github/workflows/refresh-lock-and-linter-dependencies.yml b/.github/workflows/refresh-lock-and-linter-dependencies.yml
index 780ab923c4..e9dc2cc14f 100644
--- a/.github/workflows/refresh-lock-and-linter-dependencies.yml
+++ b/.github/workflows/refresh-lock-and-linter-dependencies.yml
@@ -111,6 +111,9 @@ jobs:
         with:
           client-id: ${{ secrets.CI_BOT_APP_ID }}
           private-key: ${{ secrets.CI_BOT_PRIVATE_KEY }}
+          repositories: ${{ github.repository }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: create pull request
         if: ${{ inputs.create-pr || github.event_name == 'schedule' }}