diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d47e29f..6b67074 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,7 @@ jobs:
       permissions:
         # IMPORTANT: this permission is mandatory for trusted publishing
         id-token: write
+        contents: write # for softprops/action-gh-release
       # upload to PyPI on every tag starting with 'v'
       # if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
       # alternatively, to publish when a GitHub Release is created, use the following rule:
@@ -30,8 +31,6 @@ jobs:
 
         - name: publish to github release
           uses: softprops/action-gh-release@v2
-          permissions:
-            contents: write
           if: startsWith(github.ref, 'refs/tags/')
           with:
             files: dist/*