diff --git a/.github/workflows/release-orchestrator.yml b/.github/workflows/release-orchestrator.yml
index 2c41ed516f..a0c05cbcd5 100644
--- a/.github/workflows/release-orchestrator.yml
+++ b/.github/workflows/release-orchestrator.yml
@@ -71,7 +71,7 @@ jobs:
   run-production:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.release-type == 'production' }}
     permissions:
-      contents: read
+      contents: write
       id-token: write
     uses: ./.github/workflows/release.yml
     secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6fcb4b7d5d..96640319e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,6 +54,9 @@ jobs:
   finalize-release:
     needs: [release-ionic]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
     - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       with:
@@ -82,6 +85,9 @@ jobs:
     # possible for them to push at the same time.
     needs: [finalize-release]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         # Pull the latest version of the reference