diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index f393f0a..08adfbd 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -5,6 +5,10 @@ on:
     - cron: "0 */6 * * *" # run every 6 hours
   workflow_dispatch:
 
+permissions:
+  contents: write
+  actions: write
+
 jobs:
   sync_latest_from_upstream:
     name: Sync latest commits from upstream repo