diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9c2ef0c..19554fab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -110,6 +110,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write  # to add comments to the PR
+      checks: write
 
     services:
       postgres:
@@ -238,6 +239,9 @@ jobs:
     uses: maykinmedia/open-api-workflows/.github/workflows/ci.yml@v6
     needs:
       - store-reusable-workflow-vars
+    permissions:
+      contents: read
+      security-events: write  # required for `Scan docker image` step
     with:
       main-branch: 'master'
       apt-packages: 'gdal-bin graphviz graphviz-dev'