diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af268369..62d875bf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,5 @@
 name: CI
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/label-issues.yml b/.github/workflows/label-issues.yml
index 88008715..7e570a4e 100644
--- a/.github/workflows/label-issues.yml
+++ b/.github/workflows/label-issues.yml
@@ -1,14 +1,17 @@
 name: Label issues
+
+permissions:
+  issues: write
+
 on:
   issues:
     types:
       - reopened
       - opened
+
 jobs:
   label_issues:
     runs-on: ubuntu-latest
-    permissions:
-      issues: write
     steps:
       - run: gh issue edit "$NUMBER" --add-label "$LABELS"
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d5cc55db..a8173640 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,11 +1,11 @@
 name: Release
 
-on:
-  workflow_dispatch:
-
 permissions:
   contents: write
 
+on:
+  workflow_dispatch:
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest