diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 64dbe271..f130a65a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,8 +23,9 @@ jobs:
   build:
     uses: ./.github/workflows/build.yml
     permissions:
-      id-token: write
       attestations: write
+      contents: read
+      id-token: write
     with:
       version: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || '' }}
 
@@ -40,12 +41,9 @@ jobs:
     needs: [build, test]
     environment: release
     permissions:
-      # Use to sign the release artifacts
-      id-token: write
-      # Used to upload release artifacts
-      contents: write
-      # Used to generate artifact attestation
       attestations: write
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v5
         with: