diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fdbc5746e..c23904ed2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,6 +81,8 @@ jobs:
       ref: ${{ needs.release-drafter.outputs.tag_name }}
 
   build-changelog-scrubber-lambda:
+    permissions:
+      contents: read
     needs:
       - release-drafter
     uses: ./.github/workflows/build-changelog-scrubber-lambda.yml