diff --git a/.github/workflows/orchestrator.yml b/.github/workflows/orchestrator.yml
index 79ea4d6444..3a4457b560 100644
--- a/.github/workflows/orchestrator.yml
+++ b/.github/workflows/orchestrator.yml
@@ -8,6 +8,12 @@ on:
       - 'release/**'
   merge_group:
 
+permissions:
+  contents: 'read'
+  packages: 'write'
+  pull-requests: 'write'
+  security-events: 'write'
+
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
   cancel-in-progress: true