diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 837a0fbc79..0686bb1619 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,8 +14,6 @@
 name: Release
 run-name: Release ${{ inputs.tag }}
 
-permissions:
-  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -34,17 +32,28 @@ jobs:
   pr:
     name: PR
     uses: ./.github/workflows/on-pr.yml
+    permissions:
+      pull-requests: write
+      contents: read
 
   pr-target:
     name: PR Target
     uses: ./.github/workflows/on-pr-target.yml
+    secrets: inherit
+    permissions:
+      contents: write
+      pages: write
+      pull-requests: write
+      id-token: write
+      actions: read
+      issues: write
 
   create-release:
     name: Create release
     needs:
       - pr
       - pr-target
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     env: