diff --git a/.github/workflows/_release.yml b/.github/workflows/_release.yml
index 8443cca30bf..8aa093abdd6 100644
--- a/.github/workflows/_release.yml
+++ b/.github/workflows/_release.yml
@@ -37,7 +37,7 @@ env:
   UV_NO_SYNC: "true"
 
 permissions:
-  contents: write # Required for creating GitHub releases
+  contents: read # Job-level overrides grant write only where needed (mark-release)
 
 jobs:
   # Build the distribution package and extract version info