diff --git a/.github/workflows/post-pr-comments.yml b/.github/workflows/post-pr-comments.yml
index 9576a73..3c00116 100644
--- a/.github/workflows/post-pr-comments.yml
+++ b/.github/workflows/post-pr-comments.yml
@@ -54,8 +54,8 @@ on:
         default: "pr-comment-coverage"
 
 permissions:
-  contents: read
-  pull-requests: write
+  actions: read # needed for gh run download (artifact access)
+  pull-requests: write # needed for posting PR comments
 
 jobs:
   post-comments: