diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bcbd86c..6294fdf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,10 +9,12 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   release:
+    permissions:
+      contents: write
     if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
     uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-release.yml@5b7f2938bc31b110554c8ef5b6d38659d225f096 # main
     secrets: