diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index ad4a859..028911e 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -24,6 +24,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      security-events: write
   checks_succeeded:
     name: Checks succeeded
     needs: [build, check_docs, check_workflows]
diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml
index fa6fdbb..5a49bde 100644
--- a/.github/workflows/PR.yml
+++ b/.github/workflows/PR.yml
@@ -21,3 +21,4 @@ jobs:
       contents: read
       checks: write
       pull-requests: write
+      security-events: write
diff --git a/.github/workflows/check_workflows.yml b/.github/workflows/check_workflows.yml
index 67a49f8..b0ca0b8 100644
--- a/.github/workflows/check_workflows.yml
+++ b/.github/workflows/check_workflows.yml
@@ -11,6 +11,7 @@ jobs:
     permissions:
       actions: read
       contents: read
+      security-events: write
     steps:
       - name: Check out repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -18,6 +19,3 @@ jobs:
           persist-credentials: false
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
-        with:
-          # GitHub Advanced Security costs extra for internal repos
-          advanced-security: false
\ No newline at end of file