diff --git a/.github/workflows/smoke-multi-caller.yml b/.github/workflows/smoke-multi-caller.yml
index d5936f8e055..39c51eedf71 100644
--- a/.github/workflows/smoke-multi-caller.yml
+++ b/.github/workflows/smoke-multi-caller.yml
@@ -21,6 +21,7 @@ jobs:
       task-description: 'task-a - first invocation'
     secrets: inherit
     permissions:
+      actions: read
       contents: read
       issues: write
       pull-requests: write
@@ -36,6 +37,7 @@ jobs:
       task-description: 'task-b - second invocation'
     secrets: inherit
     permissions:
+      actions: read
       contents: read
       issues: write
       pull-requests: write
@@ -48,6 +50,7 @@ jobs:
       task-description: 'task-c - third invocation (after a and b)'
     secrets: inherit
     permissions:
+      actions: read
       contents: read
       issues: write
       pull-requests: write
diff --git a/.github/workflows/smoke-trigger.yml b/.github/workflows/smoke-trigger.yml
index 287c0df69ce..efd6d63c9e8 100644
--- a/.github/workflows/smoke-trigger.yml
+++ b/.github/workflows/smoke-trigger.yml
@@ -11,6 +11,7 @@ jobs:
     uses: ./.github/workflows/smoke-workflow-call.lock.yml
     secrets: inherit
     permissions:
+      actions: read
       contents: read
       discussions: write
       issues: write