diff --git a/.github/workflows/ci.generate.ts b/.github/workflows/ci.generate.ts
index 89cd58698d3f2..0bfdba53ce819 100755
--- a/.github/workflows/ci.generate.ts
+++ b/.github/workflows/ci.generate.ts
@@ -301,6 +301,9 @@ function handleMatrixItems(items: {
 
 const ci = {
   name: "ci",
+  permissions: {
+    contents: "write",
+  },
   on: {
     push: {
       branches: ["main"],
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c89ef6ee17f4..2e31c2140c060 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,8 @@
 # GENERATED BY ./ci.generate.ts -- DO NOT DIRECTLY EDIT
 
 name: ci
+permissions:
+  contents: write
 on:
   push:
     branches: