diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1761eeea..a3cf57d7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -57,6 +57,8 @@ jobs:
     needs:
       - tests
       - verify-tag
+    permissions:
+      contents: write # This is required to create GH releases.
     steps:
       - uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
         with:
diff --git a/.github/workflows/release_on_version_change.yaml b/.github/workflows/release_on_version_change.yaml
index 9e078c9e..4d48dac0 100644
--- a/.github/workflows/release_on_version_change.yaml
+++ b/.github/workflows/release_on_version_change.yaml
@@ -28,6 +28,8 @@ jobs:
     needs:
     - version
     uses: ./.github/workflows/release.yaml
+    permissions:
+      contents: write # This is required to create GH releases.
     with:
       tag: ${{ needs.version.outputs.version }}
       latest: ${{ needs.version.outputs.latest == 'true' }}