diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index a5e2801..a2fb5c8 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -10,6 +10,10 @@ on:
   pull_request_target:
     branches: [ main ]
   merge_group:
+
+permissions:
+  contents: read
+
 jobs:
   approve:
     name: Approve
@@ -26,6 +30,11 @@ jobs:
     name: Test ${{ matrix.job.name }} (${{ matrix.build.image }}@${{ matrix.build.tag }})
     runs-on: ubuntu-latest
     needs: approve
+    permissions:
+      # Required to publish system test results to the PR
+      issues: write
+      pull-requests: write
+      contents: read
     environment:
       name: Test Auto
     env:
@@ -100,6 +109,7 @@ jobs:
 
       - name: Send report to commit
         uses: joonvena/robotframework-reporter-action@v2.5
+        if: always() && github.event_name == 'pull_request_target'
         with:
           gh_access_token: ${{ secrets.GITHUB_TOKEN }}
           report_path: 'output'