diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 88b9b3f3010..0ec59e4cbbd 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -12,6 +12,8 @@ permissions:
 jobs:
   backport:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # required for pushing changes
     steps:
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x-0\.[0-9]+bx$ ]]; then
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 8255490abee..8414d821115 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -8,6 +8,7 @@ permissions:
 jobs:
   prepare-patch-release:
     permissions:
+      contents: write  # required for pushing changes
       pull-requests: write # required for adding labels to PRs
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 6c13fa117d8..ee8e971caf8 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -43,6 +43,7 @@ jobs:
 
   create-pull-request-against-release-branch:
     permissions:
+      contents: write  # required for pushing changes
       pull-requests: write # required for adding labels to PRs
     runs-on: ubuntu-latest
     needs: prereqs
@@ -127,6 +128,7 @@ jobs:
 
   create-pull-request-against-main:
     permissions:
+      contents: write  # required for pushing changes
       pull-requests: write # required for adding labels to PRs
     runs-on: ubuntu-latest
     needs: prereqs