diff --git a/.github/workflows/test-claude-oauth-workflow.lock.yml b/.github/workflows/test-claude-oauth-workflow.lock.yml
index 579200e7c6..193caa97ac 100644
--- a/.github/workflows/test-claude-oauth-workflow.lock.yml
+++ b/.github/workflows/test-claude-oauth-workflow.lock.yml
@@ -31,7 +31,10 @@ name: "test-claude-oauth"
     types:
     - opened
 
-permissions: read-all
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
 
 concurrency:
   group: "gh-aw-${{ github.workflow }}-${{ github.event.issue.number }}"
@@ -121,7 +124,10 @@ jobs:
   agent:
     needs: activation
     runs-on: ubuntu-latest
-    permissions: read-all
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     steps:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
diff --git a/.github/workflows/test-claude-oauth-workflow.md b/.github/workflows/test-claude-oauth-workflow.md
index 45dc0ac579..3382715077 100644
--- a/.github/workflows/test-claude-oauth-workflow.md
+++ b/.github/workflows/test-claude-oauth-workflow.md
@@ -4,6 +4,10 @@ description: Test workflow to validate CLAUDE_CODE_OAUTH_TOKEN support
 on:
   issues:
     types: [opened]
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
 engine: claude
 ---