diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c45cb57b3..216c52ebb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,11 +5,16 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: read
+
 env:
   COMPOSER_FLAGS: "--ansi --no-interaction --no-progress --no-suggest --prefer-dist"
 
 jobs:
   build:
+    permissions:
+      contents: write # for actions/create-release to create a release
     name: Upload Release Asset
     runs-on: ubuntu-latest
     steps: