diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 5e03b73..88a70b7 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -1,57 +1,59 @@
-name: Docs
-
-on:
-    push:
-        branches: [main]
-    release:
-        types: [released]
-    pull_request:
-        types: [opened, synchronize]
-
-jobs:
-    docs:
-        runs-on: ubuntu-latest
-
-        steps:
-        - uses: actions/checkout@v3
-
-        - name: Setup Python
-          uses: actions/setup-python@v4
-          with:
-              python-version: "3.10"
-
-        - name: Install Dependencies
-          run: |
-            python -m pip install --upgrade pip
-            pip install .[doc]
-
-        - name: Build HTML artifact
-          run: python build_docs.py
-
-        - name: Upload HTML artifact
-          uses: actions/upload-artifact@v1
-          with:
-              name: DocumentationHTML
-              path: docs/_build/ape-alchemy
-
-        - name: Commit and publish documentation changes to gh-pages branch
-          run: |
-              if [[ "${GITHUB_EVENT_NAME}" =~ "pull_request" ]]; then
-                echo "skipping 'git commit' step for PR"
-              else
-                git clone https://github.com/${GITHUB_REPOSITORY} --branch gh-pages --single-branch gh-pages
-                cp -r docs/_build/ape-alchemy/* gh-pages/
-                cd gh-pages
-                touch .nojekyll
-                git config --local user.email "action@github.com"
-                git config --local user.name "GitHub Action"
-                git add .
-                git commit -m "Update documentation" -a || true
-              fi
-        - name: Push changes
-          uses: ad-m/github-push-action@master
-          if: ${{ github.event_name != 'pull_request' }}
-          with:
-              branch: gh-pages
-              directory: gh-pages
-              github_token: ${{ secrets.GITHUB_TOKEN }}
+name: Docs
+
+on:
+    push:
+        branches: [main]
+    release:
+        types: [released]
+    pull_request:
+        types: [opened, synchronize]
+
+jobs:
+    docs:
+        runs-on: ubuntu-latest
+        permissions:
+          contents: write
+
+        steps:
+        - uses: actions/checkout@v3
+
+        - name: Setup Python
+          uses: actions/setup-python@v4
+          with:
+              python-version: "3.10"
+
+        - name: Install Dependencies
+          run: |
+            python -m pip install --upgrade pip
+            pip install .[doc]
+
+        - name: Build HTML artifact
+          run: python build_docs.py
+
+        - name: Upload HTML artifact
+          uses: actions/upload-artifact@v1
+          with:
+              name: DocumentationHTML
+              path: docs/_build/ape-alchemy
+
+        - name: Commit and publish documentation changes to gh-pages branch
+          run: |
+              if [[ "${GITHUB_EVENT_NAME}" =~ "pull_request" ]]; then
+                echo "skipping 'git commit' step for PR"
+              else
+                git clone https://github.com/${GITHUB_REPOSITORY} --branch gh-pages --single-branch gh-pages
+                cp -r docs/_build/ape-alchemy/* gh-pages/
+                cd gh-pages
+                touch .nojekyll
+                git config --local user.email "action@github.com"
+                git config --local user.name "GitHub Action"
+                git add .
+                git commit -m "Update documentation" -a || true
+              fi
+        - name: Push changes
+          uses: ad-m/github-push-action@master
+          if: ${{ github.event_name != 'pull_request' }}
+          with:
+              branch: gh-pages
+              directory: gh-pages
+              github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/draft.yaml b/.github/workflows/draft.yaml
index 423582b..f136f49 100644
--- a/.github/workflows/draft.yaml
+++ b/.github/workflows/draft.yaml
@@ -8,6 +8,8 @@ on:
 jobs:
   update-draft:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "main"
       - uses: release-drafter/release-drafter@v5