diff --git a/.github/workflows/pypi_release.yml b/.github/workflows/pypi_release.yml
index 465c7efa2..abbfaf8cc 100644
--- a/.github/workflows/pypi_release.yml
+++ b/.github/workflows/pypi_release.yml
@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   check_tag:
     name: Check tag
@@ -17,8 +20,10 @@ jobs:
           python-version: '3.11'
 
       - shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          TAG="${{ github.event.release.tag_name }}"
+          TAG="${RELEASE_TAG}"
           GH_TAG_NAME="${TAG#v}"
           PY_VERSION=$(python - <<'PY'
           import pathlib, tomllib