diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 29e1be26579..57296457eb0 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -41,6 +41,8 @@ jobs:
   builds:
     if: ${{ !(github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, '[maven-release-plugin]')) }}
     needs: [test-linux]
+    permissions:
+      contents: write
     runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
       - uses: browser-actions/setup-chrome@latest
@@ -88,15 +90,6 @@ jobs:
             tests (buildjet-4vcpu-ubuntu-2204-arm)
           ttl: 15
 
-      - name: Prepare Draft Release
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/')
-        with:
-          draft: true
-          files: ${{ steps.build-artifact.outputs.artifact-root-dir}}/**/*
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Deploy
         if: startsWith(github.ref, 'refs/tags/v')
         uses: usethesource/releases-maven-action@v1
@@ -109,6 +102,15 @@ jobs:
           ssh-username: ${{ secrets.RELEASE_SSH_USERNAME }}
           ssh-private-key: ${{ secrets.RELEASE_SSH_PRIVATE_KEY }}
 
+      - name: Prepare Draft Release
+        uses: softprops/action-gh-release@v1
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          draft: true
+          files: ${{ steps.build-artifact.outputs.artifact-root-dir}}/**/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 
   tests:
     if: ${{ !(github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, '[maven-release-plugin]')) }}