diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 9733609c..b528e44a 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -7,5 +7,11 @@ on:
 
 jobs:
   CLAAssistant:
+    # the reusable workflow can't exceed the caller's permissions, so grant what it needs explicitly
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: write
+      statuses: write
     uses: restatedev/restate/.github/workflows/cla.yml@main
     secrets: inherit