diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1ef98a8..df2261e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,6 +41,11 @@ jobs:
   ci:
     needs: plan
     uses: ./.github/workflows/ci.yml
+    # ci.yml's jobs read other runs' artifacts (a plugin borrows the backend main built); a called
+    # workflow's jobs are granted no more than its caller's job, so this one grants that read.
+    permissions:
+      contents: read
+      actions: read
 
   release:
     needs: [plan, ci]