diff --git a/.github/workflows/oblt-github-commands.yml b/.github/workflows/oblt-github-commands.yml
index 48df40f3343d9..1b475334bd80f 100644
--- a/.github/workflows/oblt-github-commands.yml
+++ b/.github/workflows/oblt-github-commands.yml
@@ -8,19 +8,20 @@
 name: oblt-github-commands
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - labeled
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   comment:
     if: ${{ github.event.label.name == 'ci:project-deploy-observability' }}
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with: