diff --git a/.github/workflows/security-fix-cron.yml b/.github/workflows/security-fix-cron.yml
index 64320e395..720265ecd 100644
--- a/.github/workflows/security-fix-cron.yml
+++ b/.github/workflows/security-fix-cron.yml
@@ -18,4 +18,9 @@ jobs:
     needs: security
     if: ${{ always() && needs.security.result == 'failure' }}
     uses: ./.github/workflows/_security-fix-agent.yml
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
     secrets: inherit