diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index a7b1fd997..e37a17244 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -4,6 +4,11 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: write
+  packages: write
+
 concurrency:
   group: evals-${{ github.head_ref }}
   cancel-in-progress: true