diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4f081def..cfe4c56f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,13 +1,12 @@
 name: CI
 on: push
 
-permissions:
-  contents: write
-
 jobs:
   lintfix:
     name: Lint and fix
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: 🚀 Checkout
         uses: actions/checkout@v3
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fc678a2a..cd987418 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,12 +1,6 @@
 name: Tests
 
-on:
-  deployment_status:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+on: deployment_status
 
 jobs:
   tests:
@@ -72,6 +66,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: tests
     if: always()
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     steps:
       - name: 📥 Get artifact
         uses: actions/download-artifact@v2