diff --git a/.github/workflows/set-milestone-on-pr.yml b/.github/workflows/set-milestone-on-pr.yml
index e64c797ed..5c365d0e8 100644
--- a/.github/workflows/set-milestone-on-pr.yml
+++ b/.github/workflows/set-milestone-on-pr.yml
@@ -20,6 +20,7 @@ on:
     types: [closed]
 
 permissions:
+  contents: read
   issues: write
   pull-requests: write
 
diff --git a/scripts/desktop-release-config.spec.js b/scripts/desktop-release-config.spec.js
index ae77b1473..6ce7cce87 100644
--- a/scripts/desktop-release-config.spec.js
+++ b/scripts/desktop-release-config.spec.js
@@ -13,6 +13,7 @@ const packagerPackagePath = path.join(packagerPath, 'package.json');
 const packagerLockPath = path.join(packagerPath, 'package-lock.json');
 const configPath = path.join(root, 'examples/electron/electron-builder.yml');
 const workflowPath = path.join(root, '.github/workflows/release-desktop.yml');
+const milestoneWorkflowPath = path.join(root, '.github/workflows/set-milestone-on-pr.yml');
 
 test('desktop packaging exposes production and distribution commands', () => {
     assert.equal(electronPackage.scripts['build:prod'], 'theiaext build && npm run -s bundle:prod');
@@ -92,3 +93,10 @@ test('tag builds aggregate artifacts into a draft GitHub release', () => {
     assert.match(publish.run, /SHA256SUMS/);
     assert.match(publish.run, /unsigned/i);
 });
+
+test('milestone workflow can read merged package metadata', () => {
+    const workflow = yaml.load(fs.readFileSync(milestoneWorkflowPath, 'utf8'));
+    assert.equal(workflow.permissions.contents, 'read');
+    assert.equal(workflow.permissions.issues, 'write');
+    assert.equal(workflow.permissions['pull-requests'], 'write');
+});