diff --git a/.github/workflows/build-ripunzip.yml b/.github/workflows/build-ripunzip.yml
index 8ce04c47dde..07e00bff811 100644
--- a/.github/workflows/build-ripunzip.yml
+++ b/.github/workflows/build-ripunzip.yml
@@ -17,6 +17,8 @@ on:
     paths:
       - .github/workflows/build-ripunzip.yml
 
+permissions: {}
+  
 jobs:
   versions:
     runs-on: ubuntu-slim
@@ -116,6 +118,9 @@ jobs:
   publish:
     needs: [versions, build]
     if: inputs.open-pr == 'true'
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-slim
     steps:
       # workaround for git-lfs not being installed yet on ubuntu-slim runners