diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aa390b65f12..6b5d18c4302 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,10 +2,11 @@ name: Release
 
 on:
   release:
-    permissions:
-      contents: write  # for actions/upload-release-asset to upload release asset
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     permissions:
@@ -20,6 +21,8 @@ jobs:
           TAG: ${{ github.event.release.tag_name }}
 
   release:
+    permissions:
+      contents: write  # for actions/upload-release-asset to upload release asset
     needs: setup
     runs-on: ubuntu-latest
     steps: