diff --git a/.github/workflows/latest-changes.yml b/.github/workflows/latest-changes.yml
index 6ed1cb6..759ee80 100644
--- a/.github/workflows/latest-changes.yml
+++ b/.github/workflows/latest-changes.yml
@@ -19,6 +19,8 @@ on:
 jobs:
   latest-changes:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
     steps:
       - name: Dump GitHub context
         env:
diff --git a/.github/workflows/smokeshow.yml b/.github/workflows/smokeshow.yml
index fd796a9..088eeac 100644
--- a/.github/workflows/smokeshow.yml
+++ b/.github/workflows/smokeshow.yml
@@ -5,13 +5,13 @@ on:
     workflows: [Test]
     types: [completed]
 
-permissions:
-  statuses: write
-
 jobs:
   smokeshow:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      statuses: write
 
     steps:
       - uses: actions/setup-python@v5
@@ -24,6 +24,7 @@ jobs:
         with:
           workflow: test.yml
           commit: ${{ github.event.workflow_run.head_sha }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - run: smokeshow upload coverage-html
         env: