diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b650fc520..55cd0bbf4a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,12 +6,6 @@ on:
       - "dependabot/**"
   pull_request:
 
-# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#changing-github_token-permissions
-permissions:
-  pull-requests: write
-  issues: write
-  repository-projects: write
-
 jobs:
   Windows:
     name: 'Windows (${{ matrix.python }}, ${{ matrix.arch }}${{ matrix.extra_name }})'
@@ -77,6 +71,12 @@ jobs:
     name: 'Ubuntu (${{ matrix.python }}${{ matrix.extra_name }})'
     timeout-minutes: 10
     runs-on: 'ubuntu-latest'
+    # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#changing-github_token-permissions
+    permissions:
+      pull-requests: write
+      issues: write
+      repository-projects: write
+      contents: write
     strategy:
       fail-fast: false
       matrix:
diff --git a/test-requirements.txt b/test-requirements.txt
index a65044dd89..2ea1640ff0 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -123,7 +123,7 @@ sortedcontainers==2.4.0
     # via -r test-requirements.in
 tomlkit==0.11.6
     # via pylint
-traitlets==5.8.1
+traitlets==5.9.0
     # via
     #   ipython
     #   matplotlib-inline