diff --git a/.github/workflows/sync-branches.lock.yml b/.github/workflows/sync-branches.lock.yml
index 7da366b..0a0522d 100644
--- a/.github/workflows/sync-branches.lock.yml
+++ b/.github/workflows/sync-branches.lock.yml
@@ -249,7 +249,8 @@ jobs:
   agent:
     needs: activation
     runs-on: ubuntu-latest
-    permissions: read-all
+    permissions:
+      contents: write
     env:
       GH_AW_WORKFLOW_ID_SANITIZED: syncbranches
     outputs:
diff --git a/workflows/sync-branches.md b/workflows/sync-branches.md
index 5111d05..bc01071 100644
--- a/workflows/sync-branches.md
+++ b/workflows/sync-branches.md
@@ -9,7 +9,8 @@ on:
     branches: [main]  # ← update this if your default branch is not 'main'
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: write
 
 timeout-minutes: 10