diff --git a/.github/workflows/merge-pr.yml b/.github/workflows/merge-pr.yml
index 3386d33a0..934ca0fb4 100644
--- a/.github/workflows/merge-pr.yml
+++ b/.github/workflows/merge-pr.yml
@@ -27,6 +27,10 @@ on:
         required: false
         type: boolean
 
+permissions:
+  contents: write
+  pull-requests: read
+
 jobs:
   if_merged:
     if: github.event.pull_request.merged == true || ${{github.event.inputs.force}}
diff --git a/tools/changelog.py b/tools/changelog.py
index e5113f8e9..d4f98d558 100755
--- a/tools/changelog.py
+++ b/tools/changelog.py
@@ -90,8 +90,11 @@ def write_doc(path, snippet):
 @click.argument('changelog', required=False, type=click.Path(exists=True))
 def main(token, changelog=None):
   buffer = []
-  for pr in get_pulls(token=token):
-    buffer.append(format_pull(pr))
+  try:
+    for pr in get_pulls(token=token):
+      buffer.append(format_pull(pr))
+  except Exception as e:
+    raise SystemExit(f'API error: {e}')
   buffer = '\n'.join(buffer)
   if not changelog:
     print(buffer)