diff --git a/.github/workflows-source/ci-pr-only.yml b/.github/workflows-source/ci-pr-only.yml
index 985b62bc6ab..877cb6157f9 100644
--- a/.github/workflows-source/ci-pr-only.yml
+++ b/.github/workflows-source/ci-pr-only.yml
@@ -69,8 +69,6 @@ jobs:
     name: Lock Generate
     <<: *dind-small-setup
     <<: *skip-merge-group
-    permissions:
-      pull-requests: write
     env:
       CI_EVENT_NAME: ${{ github.event_name }}
     steps:
diff --git a/.github/workflows/ci-generate-ci.yml b/.github/workflows/ci-generate-ci.yml
index 03523dd7633..0a8494de53e 100644
--- a/.github/workflows/ci-generate-ci.yml
+++ b/.github/workflows/ci-generate-ci.yml
@@ -12,9 +12,6 @@ on:
 env:
   CI_PROJECT_DIR: ${{ github.workspace }}
 
-permissions:
-  pull-requests: write
-
 jobs:
   generate-ci:
     name: Generate CI
diff --git a/.github/workflows/ci-pr-only.yml b/.github/workflows/ci-pr-only.yml
index e22d0d8bc59..4fc0d051bf9 100644
--- a/.github/workflows/ci-pr-only.yml
+++ b/.github/workflows/ci-pr-only.yml
@@ -54,8 +54,6 @@ jobs:
       options: >-
         -e NODE_NAME
     if: ${{ github.event_name != 'merge_group' }}
-    permissions:
-      pull-requests: write
     env:
       CI_EVENT_NAME: ${{ github.event_name }}
     steps:
diff --git a/.github/workflows/container-base-images.yml b/.github/workflows/container-base-images.yml
index 9e5c14294b7..3e8fc4a1720 100644
--- a/.github/workflows/container-base-images.yml
+++ b/.github/workflows/container-base-images.yml
@@ -18,16 +18,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  packages: write
-  contents: write
-
 jobs:
   build-base-image:
     name: Build Base Container Image
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    permissions:
+      packages: write
+      contents: write
     strategy:
       matrix:
         include:
@@ -119,6 +117,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Get Current Date
         id: date
@@ -142,7 +142,6 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5
         with:
-          token: ${{ steps.app-token.outputs.token }}
           base: master
           branch: base-image-refs-update-${{ env.DATE }}
           delete-branch: true
diff --git a/.github/workflows/update-mainnet-revisions.yaml b/.github/workflows/update-mainnet-revisions.yaml
index dfb25efb467..75048ccde07 100644
--- a/.github/workflows/update-mainnet-revisions.yaml
+++ b/.github/workflows/update-mainnet-revisions.yaml
@@ -28,8 +28,6 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Update IC versions file
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -eEuxo pipefail
 
@@ -63,8 +61,6 @@ jobs:
           version: 2.53.0
 
       - name: Update Mainnet canisters file
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -eEuxo pipefail