diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index aee4258f7bb7..840382d99726 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -9,7 +9,9 @@ on:
   pull_request_target:
     types: [closed, labeled]
 
-permissions: {}
+permissions:
+  contents: read
+  pull-requests: write
 
 jobs:
   backport:
@@ -48,7 +50,8 @@ jobs:
       - name: "Add 'has: port to stable' label"
         if: steps.backport.outputs.created_pull_numbers != ''
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          # Not the app on purpose to avoid triggering another workflow run after adding this label
+          GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
         run: |