diff --git a/.github/workflows/comment-bot.yml b/.github/workflows/comment-bot.yml
index 2a87fe4..0df0480 100644
--- a/.github/workflows/comment-bot.yml
+++ b/.github/workflows/comment-bot.yml
@@ -6,6 +6,10 @@ jobs:
   tag:  # /tag <tagname> <commit>
     if: startsWith(github.event.comment.body, '/tag ')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
     steps:
     - uses: actions/checkout@v3
     - name: React Seen
@@ -27,7 +31,6 @@ jobs:
           post({
             owner: context.repo.owner, repo: context.repo.repo,
             comment_id: context.payload.comment.id, content: "eyes"})
-        github-token: ${{ secrets.GH_TOKEN }}
     - name: Tag Commit
       run: |
         git clone https://${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY} repo
@@ -47,4 +50,3 @@ jobs:
           post({
             owner: context.repo.owner, repo: context.repo.repo,
             comment_id: context.payload.comment.id, content: "rocket"})
-        github-token: ${{ secrets.GH_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6aed57b..0d9d439 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -35,7 +35,6 @@ jobs:
     - uses: actions/checkout@v3
       with:
         fetch-depth: 0
-        token: ${{ secrets.GH_TOKEN || github.token }}
     - uses: actions/setup-python@v4
       with:
         python-version: '3.x'
@@ -53,7 +52,7 @@ jobs:
         tag="${GITHUB_REF#refs/tags/}"
         gh release create --title "shtab $tag beta" --draft --notes "$changelog" "$tag" dist/${{ steps.dist.outputs.whl }} dist/${{ steps.dist.outputs.targz }}
       env:
-        GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        GH_TOKEN: ${{ github.token }}
     - name: Docs
       run: |
         pushd docs