diff --git a/.github/workflows/pull-request-preview.yml b/.github/workflows/pull-request-preview.yml
index 914327d35..baf4544ff 100644
--- a/.github/workflows/pull-request-preview.yml
+++ b/.github/workflows/pull-request-preview.yml
@@ -16,6 +16,10 @@ on:
 jobs:
   build_and_preview:
     if: '${{ github.event.pull_request.head.repo.full_name == github.repository }}'
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     outputs:
       output1: ${{ steps.deploy_firebase_hosting_channel.outputs.details_url }}
@@ -33,6 +37,10 @@ jobs:
           firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_ASTAR_APPS }}'
           projectId: astar-apps
   e2etest:
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
     timeout-minutes: 60
     runs-on: ubuntu-latest
     needs: build_and_preview