diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0919cd4ea..8738babef 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -131,6 +131,8 @@ jobs:
     needs: [build, provenance-sdist, provenance-execs]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      contents: write # to upload to release notes
     steps:
       - name: Download artifact
         uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2