diff --git a/.github/workflows/render_nanomaps.yml b/.github/workflows/render_nanomaps.yml
index 57f305772c..d6f2622041 100644
--- a/.github/workflows/render_nanomaps.yml
+++ b/.github/workflows/render_nanomaps.yml
@@ -11,8 +11,13 @@ on:
     paths:
       - 'maps/**'
 
+permissions: {}
 jobs:
   generate_maps:
+    permissions:
+      contents: write # to push to branch
+      pull-requests: write # to create pull requests (repo-sync/pull-request)
+
     name: 'Generate NanoMaps'
     runs-on: ubuntu-latest
     steps: