diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7f5d8cec..8dc1c41d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -94,6 +94,9 @@ jobs:
     runs-on: ubuntu-latest
     environment: publish
     permissions:
+      # Required to create release
+      contents: write
+      # Required for OIDC
       id-token: write
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')