diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a4c359d64be..3d5b32cf528 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -43,7 +43,12 @@ jobs:
   distcheck:
     runs-on: ubuntu-latest
     permissions:
-      contents: write # TODO: This is needed for release, maybe split the release steps to a different job?
+      # Permissions from https://github.com/googleapis/release-please-action?tab=readme-ov-file#basic-configuration
+      # TODO: This is only needed for release, maybe split the release steps to a different job?
+      contents: write
+      pull-requests: write
+      # Needed for adding labels for PRs, we shouldn't actually need this, see https://github.com/orgs/community/discussions/156181
+      issues: write
     strategy:
       matrix:
         include: