diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 95e608064..f76e1ee75 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,7 @@ jobs:
         if: always() && needs.check-changesets.outputs.has-changesets == 'true'
         environment: 'Release'
         permissions:
-            contents: write
+            contents: read
         outputs:
             committed: ${{ steps.commit-version-bump.outputs.commit-hash != '' }}
         steps:
@@ -236,7 +236,6 @@ jobs:
         if: always() && needs.version-bump.outputs.committed == 'true'
         permissions:
             contents: write
-            actions: write
         env:
             SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
             SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}