diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 85f3e92f2ffb..3c7872baab7d 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -54,6 +54,7 @@ jobs:
           BATCH_SIZE: ${{ vars.AUTO_START_CI_BATCH_SIZE || '5' }}
   start-ci:
     permissions:
+      actions: read
       checks: read
       contents: read
       pull-requests: write
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 83f921838b30..520b0239ff44 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -59,6 +59,7 @@ jobs:
     needs: get_candidate_prs
     if: needs.get_candidate_prs.outputs.candidates != ''
     permissions:
+      actions: read
       checks: read
       contents: read
       pull-requests: read