diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 2371fb24..d41cd37a 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -15,11 +15,16 @@ concurrency:
   group: update-dependencies
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   update-nuget:
 
     name: Update NuGet Packages
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # push-with-retry.sh pushes the update commit to main
     timeout-minutes: 35
     steps:
       - name: Checkout repository
@@ -71,6 +76,8 @@ jobs:
   update-npm:
     name: Update npm Packages
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # push-with-retry.sh pushes the update commit to main
     timeout-minutes: 30
     steps:
       - name: Checkout repository