diff --git a/.github/workflows/update-website.yml b/.github/workflows/update-website.yml
index 0a58ffd..a9ca069 100644
--- a/.github/workflows/update-website.yml
+++ b/.github/workflows/update-website.yml
@@ -14,20 +14,20 @@ on:
     types:
       - 'phpcs-release'
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: write
-  pages: write
-  id-token: write
-
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
 concurrency:
   group: "pages"
   cancel-in-progress: false
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   update:
+    permissions:
+      contents: write # To clone the repo and to commit the changes.
+
     # Don't run on forks.
     if: github.repository == 'PHPCSStandards/schema.phpcodesniffer.com'
 
@@ -101,6 +101,10 @@ jobs:
           path: _site/
 
   deploy:
+    permissions:
+      pages: write # To deploy to Pages.
+      id-token: write # To verify the deployment originates from an appropriate source.
+
     needs: update
 
     # Don't run on forks.