diff --git a/.github/workflows/_push-entrypoint.yaml b/.github/workflows/_push-entrypoint.yaml
index 24ac94db8..7033ab989 100644
--- a/.github/workflows/_push-entrypoint.yaml
+++ b/.github/workflows/_push-entrypoint.yaml
@@ -13,9 +13,10 @@ on:
       - 'master'
       - 'release-5[0-9]'
       - 'ci/**'
-
-permissions:
-  contents: read
+  workflow_dispatch:
+    inputs:
+      ref:
+        required: false
 
 env:
   IS_CI: 'yes'
@@ -36,6 +37,9 @@ jobs:
       otp_vsn: '26.2.1-2'
       elixir_vsn: '1.15.7'
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
@@ -132,6 +136,9 @@ jobs:
           - emqx
           - emqx-enterprise
 
+    permissions:
+      contents: read
+
     steps:
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
diff --git a/.github/workflows/run_test_cases.yaml b/.github/workflows/run_test_cases.yaml
index acc5dd34f..0c7c4adfe 100644
--- a/.github/workflows/run_test_cases.yaml
+++ b/.github/workflows/run_test_cases.yaml
@@ -44,7 +44,6 @@ jobs:
 
     permissions:
       contents: read
-      pull-requests: write
 
     steps:
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
@@ -89,7 +88,6 @@ jobs:
 
     permissions:
       contents: read
-      pull-requests: write
 
     steps:
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
@@ -158,7 +156,6 @@ jobs:
 
     permissions:
       contents: read
-      pull-requests: write
 
     env:
       PROFILE: ${{ matrix.profile }}