diff --git a/.github/workflows/security-fast.yml b/.github/workflows/security-fast.yml
index 8d47352..61faaa9 100644
--- a/.github/workflows/security-fast.yml
+++ b/.github/workflows/security-fast.yml
@@ -9,6 +9,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  security-events: write  # Required for rustsec/audit-check SARIF upload
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/security-medium.yml b/.github/workflows/security-medium.yml
index 06a0b48..7f71cb9 100644
--- a/.github/workflows/security-medium.yml
+++ b/.github/workflows/security-medium.yml
@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: read
+  security-events: write  # Required for security tool integrations
 
 env:
   CARGO_TERM_COLOR: always