diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d489453..aa360c7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -43,6 +43,9 @@ jobs:
         with:
           app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
           private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+          # Scope to what release-plz's `release` command needs: create tags
+          # and GitHub releases.
+          permission-contents: write
 
       - name: Run release-plz
         uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5
@@ -87,6 +90,10 @@ jobs:
         with:
           app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
           private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
+          # Scope to what release-plz's `release-pr` command needs: push the
+          # release branch (contents) and open/update the PR (pull-requests).
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Run release-plz
         uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5