diff --git a/.github/workflows/qwen-code-pr-review.yml b/.github/workflows/qwen-code-pr-review.yml
index ba6723fce7..167cb8909d 100644
--- a/.github/workflows/qwen-code-pr-review.yml
+++ b/.github/workflows/qwen-code-pr-review.yml
@@ -63,6 +63,10 @@ jobs:
       github.event.pull_request.head.repo.full_name != github.repository &&
       (github.event.action != 'review_requested' ||
        github.event.requested_reviewer.login == 'qwen-code-ci-bot')
+    permissions:
+      contents: 'read'
+      pull-requests: 'read'
+      issues: 'write'
     uses: './.github/workflows/qwen-pr-safety-precheck.yml'
 
   ack-review-request: