diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8f0a3429e..87b8caaa0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,8 @@ on:
     branches:
       - main
 
-permissions: read-all
+permissions:
+  contents: read
 
 # Note the only differences between release and canary-release jobs are:
 # - only canary passes --overwrite flag