diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 31389fa681..5f9925989c 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -21,8 +21,6 @@ jobs:
       tasks: jmh
 
   build_site:
-    permissions:
-      contents: write
     uses: hexagontk/hexagon/.github/workflows/site.yml@develop
 
   test_publishing:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7148746292..48150d3cc3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,5 +38,9 @@ jobs:
   build_site:
     uses: hexagontk/hexagon/.github/workflows/site.yml@develop
     needs: publish
+    permissions:
+      contents: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     with:
       options: -P pushSite=true
diff --git a/.github/workflows/release_branch.yml b/.github/workflows/release_branch.yml
index feb96d3258..6e333b66b5 100644
--- a/.github/workflows/release_branch.yml
+++ b/.github/workflows/release_branch.yml
@@ -37,5 +37,9 @@ jobs:
   push_site:
     uses: hexagontk/hexagon/.github/workflows/site.yml@develop
     needs: publish
+    permissions:
+      contents: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     with:
       options: -P pushSite=true
diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml
index 2e225d904e..6f726b5e78 100644
--- a/.github/workflows/site.yml
+++ b/.github/workflows/site.yml
@@ -59,9 +59,7 @@ jobs:
           java-version: ${{ inputs.java }}
           cache: gradle
 
-      - env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
+      - run: |
           export GIT_COMMITTER_NAME="${GITHUB_ACTOR}"
           export GIT_COMMITTER_EMAIL="project@hexagontk.com"
           ./gradlew --stacktrace build