diff --git a/.github/workflows/release_from_branches.yml b/.github/workflows/release_from_branches.yml
index 5286cc18e04..afce74d51c3 100644
--- a/.github/workflows/release_from_branches.yml
+++ b/.github/workflows/release_from_branches.yml
@@ -3,6 +3,9 @@ on:
   push:
     branches:
       - 'release-go_router'
+permissions:
+  # Release needs to push a tag back to the repo.
+  contents: write
 jobs:
   release:
     uses: ./.github/workflows/reusable_release.yml