diff --git a/.github/workflows/label-pr.yaml b/.github/workflows/label-pr.yaml
index b2ff9d4d..1d4b4a94 100644
--- a/.github/workflows/label-pr.yaml
+++ b/.github/workflows/label-pr.yaml
@@ -1,9 +1,5 @@
 name: Label PRs by Type of Change
 
-permissions:
-  pull-requests: write
-  issues: write
-
 on:
   pull_request:
     types: [opened, edited, synchronize]
@@ -11,6 +7,10 @@ on:
 jobs:
   label-pr:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+      contents: read  # Often needed for github-script
     steps:
       - name: Check PR body for Type of Change
         uses: actions/github-script@v7