diff --git a/.github/workflows/publish_charm_backends_config.yaml b/.github/workflows/publish_charm_backends_config.yaml
index b98335ed..223a2481 100644
--- a/.github/workflows/publish_charm_backends_config.yaml
+++ b/.github/workflows/publish_charm_backends_config.yaml
@@ -4,11 +4,14 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - main
+    - main
 
 jobs:
   publish-to-edge:
     uses: canonical/operator-workflows/.github/workflows/publish_charm.yaml@main
+    permissions:
+      actions: read
+      contents: write
     secrets: inherit
     with:
       channel: latest/edge
diff --git a/.github/workflows/publish_charm_content_cache.yaml b/.github/workflows/publish_charm_content_cache.yaml
index 1cc68671..5d673589 100644
--- a/.github/workflows/publish_charm_content_cache.yaml
+++ b/.github/workflows/publish_charm_content_cache.yaml
@@ -4,11 +4,14 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - main
+    - main
 
 jobs:
   publish-to-edge:
     uses: canonical/operator-workflows/.github/workflows/publish_charm.yaml@main
+    permissions:
+      actions: read
+      contents: write
     secrets: inherit
     with:
       channel: 1/edge