diff --git a/.github/workflows/update-cli.yml b/.github/workflows/update-cli.yml
index f24755698cb..fb104baad7c 100644
--- a/.github/workflows/update-cli.yml
+++ b/.github/workflows/update-cli.yml
@@ -11,6 +11,8 @@ jobs:
   update-cli:
     outputs:
       has_changes: ${{ steps.status.outputs.has_changes }}
+    permissions:
+      contents: write
     name: Update CLI
     if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
@@ -43,7 +45,7 @@ jobs:
         id: status
         run: |
           if [ -n "$(git status --porcelain)" ]; then
-            echo "::set-output name=has_changes::1"
+            echo "has_changes=1" >> "$GITHUB_OUTPUT"
           fi
       - name: Check in source updates
         if: steps.status.outputs.has_changes == '1'
@@ -55,4 +57,9 @@ jobs:
   publish:
     needs: update-cli
     if: needs.update-cli.outputs.has_changes == '1'
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+      actions: read
     uses: ./.github/workflows/publish.yml
diff --git a/cli/scripts/template-oss/update-cli-yml.hbs b/cli/scripts/template-oss/update-cli-yml.hbs
index 6ba36225d28..07481ff057d 100644
--- a/cli/scripts/template-oss/update-cli-yml.hbs
+++ b/cli/scripts/template-oss/update-cli-yml.hbs
@@ -9,6 +9,8 @@ jobs:
   update-cli:
     outputs:
       has_changes: $\{{ steps.status.outputs.has_changes }}
+    permissions:
+      contents: write
     {{> jobYml jobName="Update CLI" }}
       - name: Build documentation
         run: npm run build -w cli
@@ -20,7 +22,7 @@ jobs:
         id: status
         run: |
           if [ -n "$(git status --porcelain)" ]; then
-            echo "::set-output name=has_changes::1"
+            echo "has_changes=1" >> "$GITHUB_OUTPUT"
           fi
       - name: Check in source updates
         if: steps.status.outputs.has_changes == '1'
@@ -32,4 +34,9 @@ jobs:
   publish:
     needs: update-cli
     if: needs.update-cli.outputs.has_changes == '1'
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+      actions: read
     uses: ./.github/workflows/publish.yml