diff --git a/.forgejo/workflows/autolabel.yml b/.forgejo/workflows/autolabel.yml
index 0009550c05..3eb8cd52ba 100644
--- a/.forgejo/workflows/autolabel.yml
+++ b/.forgejo/workflows/autolabel.yml
@@ -4,11 +4,6 @@ on:
   issues:
     types: [opened, edited]
 
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
 jobs:
   pr_labeler:
     runs-on: utilities
@@ -20,9 +15,11 @@ jobs:
         if: ${{ forge.event_name == 'pull_request_target' }}
         with:
           configuration-path: .forgejo/labeler/labeler.yml
+          repo-token: ${{ secrets.AUTOLABELER_TOKEN }}
       - name: Label by title-match
         uses: https://github.com/actions/github-script@v7
         with:
           script: |
             const script = require('.forgejo/labeler/labeler.js')
             await script({github, context})
+          github-token: ${{ secrets.AUTOLABELER_TOKEN }}