diff --git a/.github/workflows/publish-release-artifacts.yml b/.github/workflows/publish-release-artifacts.yml
index a708b057fd..022a3b72a9 100644
--- a/.github/workflows/publish-release-artifacts.yml
+++ b/.github/workflows/publish-release-artifacts.yml
@@ -40,6 +40,8 @@ jobs:
     # only run if `check-tag` completes successfully
     needs: check-tag
     runs-on: ubuntu-latest
+    permissions:
+      - contents: write
     steps:
         # TODO: replace with artifact upload/download -- make sure there's no race condition with other builds also
         # uploaading an artifact.