diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d4cecc44..af26f730 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -307,6 +307,10 @@ jobs:
       - plan
       - host
     if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
+    permissions:
+      contents: read
+      id-token: write
+      packages: "write"
     uses: ./.github/workflows/publish-npm.yml
     with:
       plan: ${{ needs.plan.outputs.val }}