diff --git a/scripts/cms-any/tag-patch-release.php b/scripts/cms-any/tag-patch-release.php
index c6d6c37..4cc5af0 100644
--- a/scripts/cms-any/tag-patch-release.php
+++ b/scripts/cms-any/tag-patch-release.php
@@ -2,6 +2,19 @@
 
 $account = module_account();
 
+$permissions = <<<EOT
+permissions:
+      contents: write
+EOT;
+if (is_gha_repository()) {
+  // gha repositories will dispatch auto-tag.yml from within the gha-tag-release action
+  $permissions = <<<EOT
+  permissions:
+        actions: write
+        contents: write
+  EOT;
+}
+
 $content = <<<EOT
 name: Tag patch release
 
@@ -22,8 +35,7 @@
     # Only run cron on the $account account
     if: (github.event_name == 'schedule' && github.repository_owner == '$account') || (github.event_name != 'schedule')
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
+    $permissions
     steps:
       - name: Tag release
         uses: silverstripe/gha-tag-release@v2