diff --git a/.github/workflows/update-translations.yml b/.github/workflows/update-translations.yml
index f7107c6d..141d9a72 100644
--- a/.github/workflows/update-translations.yml
+++ b/.github/workflows/update-translations.yml
@@ -6,14 +6,15 @@ on:
     paths:
       - "src/main/resources/messages_en_GB.properties"
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   update-translations-main:
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2