diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7530793a8..d93313ed3 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -34,6 +34,7 @@ jobs:
   check-gate:
     if: ${{ github.event.inputs.phase == 'all' }}
     permissions:
+      contents: read
       checks: read # required for getting the status of specific check names
     uses: anchore/workflows/.github/workflows/check-gate.yaml@b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5 # v0.7.0
     with: