diff --git a/.github/workflows/cherrypick.yaml b/.github/workflows/cherrypick.yaml
index cbceef0cb9e..32fa2cf2a5b 100644
--- a/.github/workflows/cherrypick.yaml
+++ b/.github/workflows/cherrypick.yaml
@@ -6,11 +6,13 @@ on:
     types: ["closed"]
 
 permissions:
-  pull-requests: write
-  contents: write
+  contents: read
 
 jobs:
   cherry_pick_release_v1_0:
+    permissions:
+      pull-requests: write
+      contents: write
     runs-on: ubuntu-22.04
     name: Cherry pick into release-v1.0
     if: ${{ contains(github.event.pull_request.labels.*.name, 'cherrypick/release-v1.0') && github.event.pull_request.merged == true }}