diff --git a/.github/workflows/tag-and-release.yml b/.github/workflows/tag-and-release.yml
index 7180b59e..ee551131 100644
--- a/.github/workflows/tag-and-release.yml
+++ b/.github/workflows/tag-and-release.yml
@@ -5,6 +5,7 @@ name: Tag & Release
     branches:
       - stackhpc/xena
 permissions:
+  actions: read
   contents: write
 jobs:
   tag-and-release: