diff --git a/.github/workflows/assign-asset-label.yml b/.github/workflows/assign-asset-label.yml
index f4b9ac5c473b..b5a3187d0414 100644
--- a/.github/workflows/assign-asset-label.yml
+++ b/.github/workflows/assign-asset-label.yml
@@ -1,15 +1,17 @@
 name: '[Support] Assign asset label'
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
 permissions:
-  pull-requests: write
-  issues: write
+  # Remove all permissions by default
+  contents: none
 jobs:
   assign-label:
     name: Assign label
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - id: get-asset
         name: Get modified assets