diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cc4e803..387c19f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,9 @@ jobs:
 
   cross-build:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+
     env:
       # see https://woodruffw.github.io/zizmor/audits/#template-injection
       REF_NAME: ${{ github.ref_name }}