diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index 1ab84313..f7a5c4c5 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -2,13 +2,13 @@ name: Benchmarks
 
 on: [workflow_call, workflow_dispatch]
 
+# Sets permissions of the GITHUB_TOKEN to allow writing back to `master`
+permissions:
+  contents: write
 
 jobs:
   run-benchmarks:
     runs-on: "cirun-benchmark-runner--${{ github.run_id }}"
-    # Sets permissions of the GITHUB_TOKEN to allow writing back to `master`
-    permissions:
-      contents: write
     steps:
       # Install git first; otherwise actions/checkout silently falls back
       # to github REST API for downloading the repo
diff --git a/.github/workflows/publish_docs.yml b/.github/workflows/publish_docs.yml
index b181bc2b..7f6e94a9 100644
--- a/.github/workflows/publish_docs.yml
+++ b/.github/workflows/publish_docs.yml
@@ -9,7 +9,7 @@ on:
 
 # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
-  contents: read
+  contents: write
   pages: write
   id-token: write