diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c38b85b8..4a264d30 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,10 @@ concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   # ── Run full CI before building release ───────────────────────────────
   ci: