diff --git a/.github/workflows/preview-smoke.yml b/.github/workflows/preview-smoke.yml
index ffd5c8b..a4f7a73 100644
--- a/.github/workflows/preview-smoke.yml
+++ b/.github/workflows/preview-smoke.yml
@@ -19,6 +19,18 @@ concurrency:
   group: preview-smoke-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+# Default workflow token is read-only on this repo. The `wait-for-vercel-preview`
+# action needs `deployments: read` to query Vercel's GitHub Deployment status,
+# plus `statuses: read` because some Vercel deployments use commit statuses
+# instead of the Deployments API. `pull-requests: read` lets it correlate the
+# deployment back to this PR. Without these, the action 403s on the Checks API
+# and the smoke job fails before Playwright even starts.
+permissions:
+  contents: read
+  deployments: read
+  pull-requests: read
+  statuses: read
+
 jobs:
   gate:
     name: Should run?
diff --git a/.github/workflows/visual-diff.yml b/.github/workflows/visual-diff.yml
index 5c34b87..eec3606 100644
--- a/.github/workflows/visual-diff.yml
+++ b/.github/workflows/visual-diff.yml
@@ -18,6 +18,16 @@ concurrency:
   group: visual-diff-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+# `deployments: read` + `statuses: read` are required by wait-for-vercel-preview
+# (see preview-smoke.yml for context). `pull-requests: write` is required by the
+# final github-script step that posts the "Visual Diff" comment back to the PR;
+# without it the API returns 403 even though the screenshots upload fine.
+permissions:
+  contents: read
+  deployments: read
+  pull-requests: write
+  statuses: read
+
 jobs:
   gate:
     name: Should run?