diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 9c3a4e9b6..3c86757eb 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -17,6 +17,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: read
+      actions: write
     # Only run if this is a release commit created by script/release.
     # Match either the direct commit message from script/release
     # ("release X.Y.Z") or the merge-commit body containing the release