diff --git a/.github/workflows/render_nanomaps.yml b/.github/workflows/render_nanomaps.yml
index 403bc8dc77d..a66acdc31ec 100644
--- a/.github/workflows/render_nanomaps.yml
+++ b/.github/workflows/render_nanomaps.yml
@@ -9,8 +9,14 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   generate_maps:
+    permissions:
+      contents: write  # for Git to git push
+      pull-requests: write  # for repo-sync/pull-request to create pull requests
     name: 'Generate NanoMaps'
     runs-on: ubuntu-18.04
     steps: