diff --git a/.github/workflows/ci-full.yml b/.github/workflows/ci-full.yml
index ac6872be6..7a42fa6ec 100644
--- a/.github/workflows/ci-full.yml
+++ b/.github/workflows/ci-full.yml
@@ -74,6 +74,10 @@ jobs:
   dylint:
     if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'ci-full')
     needs: verify
+    # The merge-queue cache janitor in dylint.yml declares `actions: write`.
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/dylint.yml
     with:
       ref: ${{ needs.verify.outputs.candidate_sha }}
diff --git a/.github/workflows/release-auto.yml b/.github/workflows/release-auto.yml
index ba3298e50..5615004a9 100644
--- a/.github/workflows/release-auto.yml
+++ b/.github/workflows/release-auto.yml
@@ -263,6 +263,12 @@ jobs:
     name: Full validation on release commit
     needs: prepare
     if: needs.prepare.outputs.should_build == 'true'
+    # dylint.yml's merge-queue cache janitor declares `actions: write`; a
+    # called workflow may not request more than its caller grants, or the
+    # whole release run fails at startup.
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/ci-full.yml
     with:
       candidate_sha: ${{ needs.prepare.outputs.release_ref }}