diff --git a/.github/workflows/approved-label.yml b/.github/workflows/approved-label.yml
index 9fbc5ed0ae8..c9d2d1ac010 100644
--- a/.github/workflows/approved-label.yml
+++ b/.github/workflows/approved-label.yml
@@ -1,14 +1,16 @@
 on: pull_request_review
 name: Add "approved" label when approved
+permissions:
+  pull-requests: write
 jobs:
   add_label:
     name: Add "approved" label when approved
     runs-on: ubuntu-latest
     steps:
-    - name: Add "approved" label when approved
-      uses: pullreminders/label-when-approved-action@master
-      env:
-        APPROVALS: "1"
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        ADD_LABEL: "approved"
-        REMOVE_LABEL: ""
+      - name: Add "approved" label when approved
+        uses: pullreminders/label-when-approved-action@master
+        env:
+          APPROVALS: "1"
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ADD_LABEL: "approved"
+          REMOVE_LABEL: ""