diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index aea7d50..c8ebd6c 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -17,6 +17,12 @@ on:
 
 jobs:
   prepare-release:
+    # Explicit token grant: the repo default is read-only, and a reusable
+    # workflow cannot exceed the caller's grant. prepare-release.yml opens a
+    # version-bump PR, which needs contents: write + pull-requests: write.
+    permissions:
+      contents: write
+      pull-requests: write
     # Pinned to @main for now; repin to a released tag (e.g. @v1) once one is cut.
     uses: apius-tech/splunk-app-ci/.github/workflows/prepare-release.yml@main
     with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0a681a7..ae5bc01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,6 +23,11 @@ jobs:
 
   release:
     needs: version
+    # Explicit token grant: the repo default is read-only, and a reusable
+    # workflow cannot exceed the caller's grant. release.yml creates a GitHub
+    # Release, which needs contents: write.
+    permissions:
+      contents: write
     # Pinned to @main for now; repin to a released tag (e.g. @v1) once one is cut.
     uses: apius-tech/splunk-app-ci/.github/workflows/release.yml@main
     with: