diff --git a/.github/workflows/apply-precommit.yml b/.github/workflows/apply-precommit.yml
index a416a2d2..37b1bec4 100644
--- a/.github/workflows/apply-precommit.yml
+++ b/.github/workflows/apply-precommit.yml
@@ -9,6 +9,8 @@ jobs:
   lint:
     if: github.repository_owner == 'TYPO3-documentation'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write        # needed to push commit
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
@@ -62,7 +64,7 @@ jobs:
 
       - name: Open Pull Request
         if: env.FIX_NEEDED == 'true' && env.EXISTING_PR != 'true'
-        uses: repo-sync/pull-request@v2
+        uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5
         with:
           source_branch: ${{ env.branch_name }}
           destination_branch: ${{ github.ref_name }}
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 18f2e8bc..dc58293d 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -9,8 +9,11 @@ jobs:
   backport:
     runs-on: ubuntu-latest
     name: Backport
+    permissions:
+      contents: write        # needed to push the backport branch
+      pull-requests: write   # needed to open the PR
     steps:
       - name: Backport
-        uses: m-kuhn/backport@v1.2.6
+        uses: m-kuhn/backport@30b6e83906cc97bad3a02867181d6236becf68f9
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}