diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 89bb76f5..527b9856 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -707,6 +707,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      security-events: write
     env:
       CODEQL_ACTION_DIFF_INFORMED_QUERIES: "false"
     strategy:
diff --git a/tests/test_release_infrastructure.py b/tests/test_release_infrastructure.py
index af6a5595..8cf31679 100644
--- a/tests/test_release_infrastructure.py
+++ b/tests/test_release_infrastructure.py
@@ -394,6 +394,7 @@ def test_tag_release_binds_codeql_reproducibility_and_installed_artifact_smokes(
         assert pin in constraints
     assert 'language: ["python", "javascript-typescript"]' in codeql
     assert 'CODEQL_ACTION_DIFF_INFORMED_QUERIES: "false"' in codeql
+    assert "contents: read\n      security-events: write" in codeql
     assert "github/codeql-action/init@" in codeql
     assert "github/codeql-action/analyze@" in codeql
     assert "upload: never" in codeql