diff --git a/.github/workflows/license-checker.yml b/.github/workflows/license-checker.yml
index 54e121173..ead1dcdd3 100644
--- a/.github/workflows/license-checker.yml
+++ b/.github/workflows/license-checker.yml
@@ -28,7 +28,4 @@ permissions:
 
 jobs:
   check-license:
-    permissions:
-      contents: write
-      pull-requests: write
-    uses: notaryproject/notation-core-go/.github/workflows/reusable-license-checker.yml@main
\ No newline at end of file
+    uses: notaryproject/notation-core-go/.github/workflows/reusable-license-checker.yml@main
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 3bdbf430e..ea4d822c6 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,11 +16,17 @@ on:
   schedule:
     - cron: "30 1 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   stale:
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           stale-issue-message: "This issue is stale because it has been opened for 60 days with no activity. Remove stale label or comment. Otherwise, it will be closed in 30 days."
           stale-pr-message: "This PR is stale because it has been opened for 45 days with no activity. Remove stale label or comment. Otherwise, it will be closed in 30 days."
@@ -31,4 +37,3 @@ jobs:
           days-before-issue-close: 30
           days-before-pr-close: 30
           exempt-all-milestones: true
-