diff --git a/.github/workflows/bump-lockfile.yml b/.github/workflows/bump-lockfile.yml
index ddc7a98..afd55d6 100644
--- a/.github/workflows/bump-lockfile.yml
+++ b/.github/workflows/bump-lockfile.yml
@@ -1,8 +1,6 @@
 name: Update lockfiles
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -35,3 +33,6 @@ jobs:
           labels: pixi
           delete-branch: true
           add-paths: pixi.lock
+    permissions:
+      contents: write
+      pull-requests: write