diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4791aa237a..e55d4dc0a4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -225,6 +225,7 @@ jobs:
     secrets: inherit
     # publish jobs get escalated permissions
     permissions:
+      "contents": "read"
       "id-token": "write"
       "packages": "write"