diff --git a/.github/workflows/ai-pr-review.yml b/.github/workflows/ai-pr-review.yml
index 8516542f..8742352e 100644
--- a/.github/workflows/ai-pr-review.yml
+++ b/.github/workflows/ai-pr-review.yml
@@ -12,7 +12,7 @@ jobs:
       contents: read
       id-token: write
       pull-requests: write
-    uses: aws/aws-durable-execution-ci/.github/workflows/ai-pr-review.yml@71259cf476e37255752d8f9445a1a48ec92be1df
+    uses: aws/aws-durable-execution-ci/.github/workflows/ai-pr-review.yml@ac55d9f4b027e193aba9fa5a69c70bfa1bdc38ed
     with:
       prompt-path: .github/prompts/ai-pr-review.md
     secrets: inherit
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index 6dec3d84..1b424258 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -9,5 +9,8 @@ permissions: {}
 jobs:
   triage:
     permissions:
+      contents: read
+      id-token: write
       issues: write
-    uses: aws/aws-durable-execution-ci/.github/workflows/issue-triage.yml@71259cf476e37255752d8f9445a1a48ec92be1df
+    uses: aws/aws-durable-execution-ci/.github/workflows/issue-triage.yml@ac55d9f4b027e193aba9fa5a69c70bfa1bdc38ed
+    secrets: inherit
diff --git a/.github/workflows/notify.yml b/.github/workflows/notify.yml
index ec9dbc8e..320b888f 100644
--- a/.github/workflows/notify.yml
+++ b/.github/workflows/notify.yml
@@ -12,7 +12,10 @@ permissions: {}
 
 jobs:
   notify:
-    uses: aws/aws-durable-execution-ci/.github/workflows/notify.yml@71259cf476e37255752d8f9445a1a48ec92be1df
+    permissions:
+      contents: read
+      models: read
+    uses: aws/aws-durable-execution-ci/.github/workflows/notify.yml@ac55d9f4b027e193aba9fa5a69c70bfa1bdc38ed
     secrets:
       SLACK_WEBHOOK_URL_PR: ${{ secrets.SLACK_WEBHOOK_URL_PR }}
       SLACK_WEBHOOK_URL_ISSUE: ${{ secrets.SLACK_WEBHOOK_URL_ISSUE }}