diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index fb47d142d..b2d14ae0a 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -1,17 +1,26 @@
 name: Label issues
-
 # This workflow is triggered on issue comments.
 on:
   issue_comment:
     types: created
 
+permissions:
+  contents: read
+
 jobs:
   applyNeedsAttentionLabel:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      issues: write  # for hramos/needs-attention to label issues
     name: Apply Needs Attention Label
     runs-on: ubuntu-latest
+    if: github.repository == 'facebook/flipper'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Apply Needs Attention Label
-        uses: hramos/needs-attention@v1
+        uses: hramos/needs-attention@v2.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+        id: needs-attention
+      - name: Result
+        run: echo '${{ steps.needs-attention.outputs.result }}'