diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 392b1f3..8fed5b8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -7,6 +7,7 @@ on:
     types: completed
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -37,6 +38,7 @@ jobs:
         with:
           name: pr-sha
           path: /tmp/
+          github-token: ${{ github.token }}
           run-id: ${{ github.event.workflow_run.id }}
 
       - name: Print pull request HEAD SHA