diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e78834e9..e0688a747 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
     tags: [ "v*" ]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   distro-amd64:
@@ -133,6 +133,8 @@ jobs:
   release:
     needs: [ distro-amd64, distro-arm64 ]
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     steps:
       - name: Download amd64 Artifacts
         uses: actions/download-artifact@v8.0.2
@@ -248,6 +250,8 @@ jobs:
   promote:
     needs: [ verify, baremetal ]
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     env:
       TAG: ${{ github.ref_name }}
       REPO: ${{ github.repository }}
@@ -280,6 +284,8 @@ jobs:
     needs: [ verify, baremetal ]
     if: failure()
     runs-on: ubuntu-26.04
+    permissions:
+      contents: write
     env:
       TAG: ${{ github.ref_name }}
       REPO: ${{ github.repository }}
@@ -297,6 +303,8 @@ jobs:
   iso:
     needs: release
     runs-on: [ self-hosted, ci-single ]
+    permissions:
+      contents: write
     # ISO build (~60-90m) overlaps the parallel baremetal run (~120m); the
     # upload gate then waits for baremetal to finish, so the job must outlast it.
     timeout-minutes: 180