diff --git a/.github/workflows/test_docker_debian_codename_sub_v3.yml b/.github/workflows/test_docker_debian_codename_sub_v3.yml
index 824b2b5af..bb5c3cb95 100644
--- a/.github/workflows/test_docker_debian_codename_sub_v3.yml
+++ b/.github/workflows/test_docker_debian_codename_sub_v3.yml
@@ -179,6 +179,8 @@ jobs:
 
   # cleanup after test execution
   cleanup:
+    permissions:
+      actions: write
     # run only if tests didn't fail: keep the artifact to make job reruns possible
     if: ${{ !failure() }}
     needs: [build, test]
diff --git a/.github/workflows/test_docker_debian_v3.yml b/.github/workflows/test_docker_debian_v3.yml
index 673745db9..63094ced5 100644
--- a/.github/workflows/test_docker_debian_v3.yml
+++ b/.github/workflows/test_docker_debian_v3.yml
@@ -29,6 +29,9 @@ on:
         - 'packages*.txt'
         - 'requirements*.txt'
 
+permissions:
+  actions: write
+
 # let only one instance run the test so cache is not corrupted.
 # cancel already running instances as only the last run will be relevant
 concurrency: