diff --git a/.github/workflows/agent-checkin.yml b/.github/workflows/agent-checkin.yml
index 4e0c0785..0237cbe9 100644
--- a/.github/workflows/agent-checkin.yml
+++ b/.github/workflows/agent-checkin.yml
@@ -4,6 +4,10 @@ on:
     - cron: '0 2 * * *'  # UTC 02:00 = 北京 10:00
   workflow_dispatch:
 
+permissions:
+  contents: write
+  actions: read
+
 jobs:
   checkin:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/zhuyuan-daily-inspection.yml b/.github/workflows/zhuyuan-daily-inspection.yml
index 404db1e2..4bc0615f 100644
--- a/.github/workflows/zhuyuan-daily-inspection.yml
+++ b/.github/workflows/zhuyuan-daily-inspection.yml
@@ -4,6 +4,11 @@ on:
     - cron: '0 4 * * *'  # UTC 04:00 = 北京 12:00
   workflow_dispatch:
 
+permissions:
+  contents: write
+  actions: read
+  issues: write
+
 jobs:
   inspection:
     runs-on: ubuntu-latest