diff --git a/.github/workflows/tag_and_publish.yaml b/.github/workflows/tag_and_publish.yaml
index c49d0c86..68255bfe 100644
--- a/.github/workflows/tag_and_publish.yaml
+++ b/.github/workflows/tag_and_publish.yaml
@@ -6,9 +6,14 @@ on:
 
 concurrency: ${{ github.ref }}
 
+permissions:
+  contents: read  # Default: read-only; widen per-job as needed
+
 jobs:
   tag-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # For git push of version tag
     outputs:
       version: ${{ steps.tag-release.outputs.version}}
     steps:
diff --git a/VERSION b/VERSION
index 2f6094b5..2cbcd950 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1!10.18.0
+1!10.18.1