diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9fad192..55578f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
     # Keep this job on ubuntu-latest unless npm adds self-hosted provenance support.
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      contents: write  # Required to create the GitHub release
       id-token: write  # Required for OIDC trusted publishing
     # Workflow-context values are bound to env here and referenced as
     # shell variables ($TAG/$REPO/$COMMIT_SHA) in run: blocks instead of