diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 2c74e5931..793aaacbd 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -6,7 +6,8 @@ on:
     types: [opened]
 
 permissions:
-  contents: write
+  contents: read
+  issues: write
 
 jobs:
   triage:
@@ -45,4 +46,3 @@ jobs:
           It may take some time before we review a PR, so even if you don’t see activity for some time, it **does not** mean that we have forgotten about it. 
           
           Every once in a while we go through a process of prioritization, after which we are focussing on the tasks that were planned for the upcoming [milestone](https://github.com/elastic/apm-agent-dotnet/milestones). The prioritization status is typically reflected through the PR labels. It could be pending triage, a candidate for a future milestone, or have a target milestone set to it.
-          
diff --git a/.github/workflows/test-linux-reporter.yml b/.github/workflows/test-linux-reporter.yml
index e91f77a9b..f611f9a67 100644
--- a/.github/workflows/test-linux-reporter.yml
+++ b/.github/workflows/test-linux-reporter.yml
@@ -10,6 +10,8 @@ on:
 
 permissions:
   contents: read
+  actions: read
+  checks: write
 
 jobs:
   report:
diff --git a/.github/workflows/test-windows-reporter.yml b/.github/workflows/test-windows-reporter.yml
index 712c8f527..7293d6e84 100644
--- a/.github/workflows/test-windows-reporter.yml
+++ b/.github/workflows/test-windows-reporter.yml
@@ -9,7 +9,9 @@ on:
       - completed
 
 permissions:
-  contents: write
+  contents: read
+  actions: read
+  checks: write
 
 jobs:
   report: