diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 84c5c4c..7b236a0 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -11,6 +11,8 @@ jobs:
     if: "startsWith(github.event.head_commit.message, 'Bump version:')"
     name: Condarise and Tag
     uses: tidywf/.github/.github/workflows/condarise-and-tag.yaml@main
+    permissions:
+      contents: write
     with:
       pkg_name: nemo
       pkg_version: '0.0.3.9006' # bump
@@ -20,6 +22,8 @@ jobs:
     name: Pkgdownise
     needs: [condarise_and_tag]
     uses: tidywf/.github/.github/workflows/pkgdownise.yaml@main
+    permissions:
+      contents: write
     with:
       pkg_name: nemo
       pkg_version: '0.0.3.9006' # bump