diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5f4c7eb..3a95f9a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,13 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: write
+  # The shared release workflow pushes the same packages to nuget.org and, when
+  # PURVIEW_PUBLISH_GITHUB_PACKAGES=true, to GitHub Packages. A reusable workflow cannot grant
+  # more than its caller, so the permission is declared here.
+  packages: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false