diff --git a/.github/workflows/update-nightly.yml b/.github/workflows/update-nightly.yml
index 60372fddd27..282f030a31f 100644
--- a/.github/workflows/update-nightly.yml
+++ b/.github/workflows/update-nightly.yml
@@ -18,10 +18,15 @@ on:
   schedule:
     - cron: 0 4 * * *  # 4am UTC is 9pm PDT and 8pm PST
 name: Set nightly branch to master HEAD
+
+permissions: {}
+
 jobs:
   master-to-nightly:
     if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
     - uses: zofrex/mirror-branch@a8809f0b42f9dfe9b2c5c2162a46327c23d15266 # v1.0.3
       name: Set nightly branch to master HEAD