diff --git a/.github/workflows/FixPR.yml b/.github/workflows/FixPR.yml
index 3807d6fe38..aaca44294e 100644
--- a/.github/workflows/FixPR.yml
+++ b/.github/workflows/FixPR.yml
@@ -7,6 +7,9 @@ name: FixPR
 env:
   BRANCH_TARGET: main
 
+permissions:
+  contents: write  # FixPR commits Cargo.lock back to main
+
 on:
   # * only trigger on pull request closed to specific branches
   # ref: https://github.community/t/trigger-workflow-only-on-pull-request-merge/17359/9