diff --git a/.github/workflows/deploy_on_release.yml b/.github/workflows/deploy_on_release.yml
index 42ffd43d11..7831e3e91e 100644
--- a/.github/workflows/deploy_on_release.yml
+++ b/.github/workflows/deploy_on_release.yml
@@ -87,3 +87,4 @@ jobs:
     permissions:
       pages: write
       id-token: write
+      contents: write
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 816a7569ad..55207efb22 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -72,6 +72,7 @@ jobs:
     permissions:
       pages: write
       id-token: write
+      contents: write
 
   run_tutorials:
     name: Run tutorials without smoke test on latest PyTorch / GPyTorch / Ax
diff --git a/.github/workflows/publish_website.yml b/.github/workflows/publish_website.yml
index 80d7fdb4fe..d6f66a90fd 100644
--- a/.github/workflows/publish_website.yml
+++ b/.github/workflows/publish_website.yml
@@ -20,6 +20,8 @@ jobs:
     env:
       # `uv pip ...` requires venv by default. This skips that requirement.
       UV_SYSTEM_PYTHON: 1
+    permissions:
+      contents: write
     steps:
     - uses: actions/checkout@v4
       with: