diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml
index ba3d0088ca4b..d3182b231870 100644
--- a/.github/workflows/ci-build.yaml
+++ b/.github/workflows/ci-build.yaml
@@ -399,6 +399,8 @@ jobs:
     name: UI
     needs: [ changed-files ]
     if: ${{ needs.changed-files.outputs.ui == 'true' }}
+    permissions:
+      contents: write # for pushing deduplicated yarn.lock for dependabot PRs
     runs-on: ubuntu-latest
     timeout-minutes: 6
     env: