diff --git a/.github/workflows/run-version-or-publish.yml b/.github/workflows/run-version-or-publish.yml
index 41201b43..a043c2dd 100644
--- a/.github/workflows/run-version-or-publish.yml
+++ b/.github/workflows/run-version-or-publish.yml
@@ -5,7 +5,10 @@ on:
       - main
 
 permissions:
+  # required for npm provenance
   id-token: write
+  # required to create the GitHub Release
+  contents: write
 
 jobs:
   covector: