diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 673e05c069e5..d8f2cd854a51 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,9 @@ on:
 
 jobs:
   release:
+    permissions:
+      contents: write # to upload release asset (actions/upload-release-asset)
+
     name: Release cmd/protoc-gen-go-grpc
     runs-on: ubuntu-latest
     if: startsWith(github.event.release.tag_name, 'cmd/protoc-gen-go-grpc/')