diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 48150d3cc3..5621b366c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -38,9 +41,5 @@ jobs:
   build_site:
     uses: hexagontk/hexagon/.github/workflows/site.yml@develop
     needs: publish
-    permissions:
-      contents: write
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     with:
       options: -P pushSite=true
diff --git a/.github/workflows/release_branch.yml b/.github/workflows/release_branch.yml
index 6e333b66b5..06f92a3469 100644
--- a/.github/workflows/release_branch.yml
+++ b/.github/workflows/release_branch.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches: [ release/** ]
 
+permissions:
+  contents: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -37,9 +40,5 @@ jobs:
   push_site:
     uses: hexagontk/hexagon/.github/workflows/site.yml@develop
     needs: publish
-    permissions:
-      contents: write
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     with:
       options: -P pushSite=true
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index 0cac09bf4a..261a28a156 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -57,7 +57,9 @@ jobs:
           java-version: ${{ inputs.java }}
           cache: gradle
 
-      - run: |
+      - env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
           export GIT_COMMITTER_NAME="${GITHUB_ACTOR}"
           export GIT_COMMITTER_EMAIL="project@hexagontk.com"
           ./gradlew --stacktrace build