diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6774fc31..7e51feae 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,13 @@ jobs:
     name: Release
     runs-on: macos-latest
     environment: main
+    # Publishing to NPM happens through trusted publishing, which needs an OIDC
+    # token. Declaring permissions at all narrows them to exactly what is listed,
+    # so the two the changesets action already relied on are spelled out too.
+    permissions:
+      contents: write # version commits, git tags and GitHub releases
+      pull-requests: write # the "Version Packages" pull request
+      id-token: write # NPM trusted publishing
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4