diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83fe039a5..d300fa77e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,6 +88,8 @@ jobs:
     if: >-
       needs.release.outputs.published == 'true' ||
       inputs.publish-only
+    permissions:
+      contents: read
     uses: ./.github/workflows/sync-templates.yml
     # Pass only the secrets sync-templates actually uses, not the full set
     # available to this release workflow.