diff --git a/.github/workflows/tag-and-release.yml b/.github/workflows/tag-and-release.yml
index 1533fa2..4ef4d26 100644
--- a/.github/workflows/tag-and-release.yml
+++ b/.github/workflows/tag-and-release.yml
@@ -5,6 +5,7 @@ name: Tag & Release
     branches:
       - stackhpc/yoga
 permissions:
+  actions: read
   contents: write
 jobs:
   tag-and-release: