diff --git a/.github/workflows/agreements.yaml b/.github/workflows/agreements.yaml
index 4e10b4d0..8a795782 100644
--- a/.github/workflows/agreements.yaml
+++ b/.github/workflows/agreements.yaml
@@ -7,7 +7,12 @@ on:
 
 jobs:
   call-workflow-agreements:
-    uses: splunk/addonfactory-github-workflows/.github/workflows/reusable-agreements.yaml@v1.3
+    uses: splunk/addonfactory-github-workflows/.github/workflows/reusable-agreements.yaml@v1
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+      statuses: read
     secrets:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       PERSONAL_ACCESS_TOKEN: ${{ secrets.PAT_CLATOOL }}