diff --git a/.github/workflows/Java.yml b/.github/workflows/Java.yml
index 682bf046d..5ab1e092e 100644
--- a/.github/workflows/Java.yml
+++ b/.github/workflows/Java.yml
@@ -1081,7 +1081,7 @@ jobs:
         if: always()
         uses: duckdb/duckdb-workflow-trigger/dispatch@main
         with:
-          github_token: ${{ secrets.PAT_TOKEN }}
+          github_token: ${{ secrets.DUCKDB_RELEASE_DISPATCH_TOKEN }}
           event: client_ready
           client: java
           duckdb_version: ${{ inputs.duckdb_version }}
diff --git a/.github/workflows/Vendor.yml b/.github/workflows/Vendor.yml
index 324062f70..0b662c125 100644
--- a/.github/workflows/Vendor.yml
+++ b/.github/workflows/Vendor.yml
@@ -30,6 +30,10 @@ jobs:
     name: "Update Vendored Sources"
     if: ${{ github.repository == 'duckdb/duckdb-java' }}
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: read
 
     steps:
       - name: Set up Python
@@ -173,7 +177,7 @@ jobs:
         id: dispatch_java_ci
         if: ${{ steps.create_pr.outcome == 'success' || steps.update_pr.outcome == 'success' }}
         env:
-          GH_TOKEN: ${{ secrets.PAT_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUM: ${{ steps.create_pr.outputs.pr_num || steps.check_pr_exists.outputs.pr_num }}
         run: |
             gh workflow run Java.yml \