diff --git a/.github/workflows/buildtest.yaml b/.github/workflows/buildtest.yaml
index 87fe86b7d..396f0d343 100644
--- a/.github/workflows/buildtest.yaml
+++ b/.github/workflows/buildtest.yaml
@@ -21,6 +21,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read # Lint and test only read the checkout
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/generate.yaml b/.github/workflows/generate.yaml
index a645ad528..976508793 100644
--- a/.github/workflows/generate.yaml
+++ b/.github/workflows/generate.yaml
@@ -19,6 +19,9 @@ on:
   push:
     branches-ignore: [main]
 
+permissions:
+  contents: write # Required to commit the regenerated output
+
 jobs:
   generate:
     runs-on: ubuntu-latest
diff --git a/agent/token.go b/agent/token.go
index 8484435cf..9d1331930 100644
--- a/agent/token.go
+++ b/agent/token.go
@@ -11,6 +11,7 @@ func BuildAgentToken(
 	apiKey, secret, roomName, participantIdentity, participantName, participantMetadata string,
 	participantAttributes map[string]string,
 	permissions *livekit.ParticipantPermission,
+	kindDetails ...livekit.ParticipantInfo_KindDetail,
 ) (string, error) {
 	grant := &auth.VideoGrant{
 		RoomJoin:             true,
@@ -29,6 +30,7 @@ func BuildAgentToken(
 		SetIdentity(participantIdentity).
 		SetName(participantName).
 		SetKind(livekit.ParticipantInfo_AGENT).
+		SetKindDetail(kindDetails...).
 		SetValidFor(1 * time.Hour).
 		SetMetadata(participantMetadata).
 		SetAttributes(participantAttributes)