diff --git a/docs/usage/getting-started/running.md b/docs/usage/getting-started/running.md
index cff201ef9c54e73c75670293e4baa140a609c3c2..3af27be0f58381deb9d07ba056e07cea424b7d8c 100644
--- a/docs/usage/getting-started/running.md
+++ b/docs/usage/getting-started/running.md
@@ -187,6 +187,13 @@ Don't forget to configure `platform=gitlab` somewhere in config.
 #### Bitbucket Cloud
 
 First, [create an AppPassword](https://confluence.atlassian.com/bitbucket/app-passwords-828781300.html) for the bot account.
+Give the bot App password the following permission scopes:
+
+- [`account`](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#account) (Account: Read)
+- [`team`](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#team) (Workspace membership: Read)
+- [`issue:write`](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#issue-write) (Issues: Write)
+- [`pullrequest:write`](https://developer.atlassian.com/cloud/bitbucket/rest/intro/#pullrequest-write) (Pull requests: Write)
+
 Configure it as `password` in your `config.js` file, or in environment variable `RENOVATE_PASSWORD`, or via CLI `--password=`.
 Also be sure to configure the `username` for your bot account too.
 Don't forget to configure `platform=bitbucket` somewhere in config.