diff --git a/.github/workflows/label-automation.yml b/.github/workflows/label-automation.yml
index d6ee04c..783a334 100644
--- a/.github/workflows/label-automation.yml
+++ b/.github/workflows/label-automation.yml
@@ -11,13 +11,13 @@ on:
   pull_request_target:
     types: [labeled, unlabeled]
 
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
 jobs:
   handle-label:
     uses: ./.github/workflows/reusable-label-commenter.yml
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     with:
       config-path: '.github/label-descriptions.yml'
+    secrets: inherit
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index dc9f8d4..bbce703 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -15,15 +15,15 @@ on:
         required: true
         type: number
 
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
 jobs:
   validate-commits:
     uses: ./.github/workflows/reusable-sob-validator.yml
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     with:
       config-path: '.github/label-descriptions.yml'
       sob-label: 'signed off by'
       pr-number: ${{ github.event_name == 'workflow_dispatch' && format('{0}', inputs.pr_number) || '' }}
+    secrets: inherit