diff --git a/.github/workflows/cacert-update.yml b/.github/workflows/cacert-update.yml
index 16cf69f6c3d78..8c2333053fc18 100644
--- a/.github/workflows/cacert-update.yml
+++ b/.github/workflows/cacert-update.yml
@@ -7,8 +7,14 @@ on:
     # Runs on the first day of every month at 03:00
     - cron:  '0 3 1 * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write  # for peter-evans/create-pull-request to create branch
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR
     if: (github.event_name == 'schedule' && github.repository == 'joomla/joomla-cms') || (github.event_name != 'schedule')
 
     runs-on: ubuntu-latest