diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7258e0d64..d0e294460 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,8 +6,13 @@ on:
     - "v[0-9]+.[0-9]+.[0-9]+"
     # match semver pre-releases
     - "v[0-9]+.[0-9]+.[0-9]+-*"
+permissions:
+  contents: read
+
 jobs:
   release:
+    permissions:
+      contents: write  # for softprops/action-gh-release to create GitHub release
     env:
       NETLIFY_BASE: 'videojs-preview.netlify.app'
     runs-on: ubuntu-latest
@@ -66,6 +71,8 @@ jobs:
           discussion_category_name: Releases
 
   deploy:
+    permissions:
+      contents: none
     needs: release
     runs-on: ubuntu-latest
     environment: Deploy