diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 066c89d05..282c944ba 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -8,7 +8,9 @@ on:
     branches: [ main ] # Redundant, workflow_run events are only triggered on default branch (`main`)
 
 permissions:
-  contents: read
+  contents: write
+  actions: write
+  secrets: write  # pragma: allowlist secret
 
 jobs:
   rotate-secret: