diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6710452..54012d4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,6 +130,7 @@ jobs:
     name: Validate and publish immutable chart
     needs: [image, image-validation, version-promotion]
     permissions:
+      actions: read
       contents: read
       id-token: write
     uses: ./.github/workflows/chart-release.yml
diff --git a/.test/release-workflow.sh b/.test/release-workflow.sh
index cd2a161..eb1f78b 100755
--- a/.test/release-workflow.sh
+++ b/.test/release-workflow.sh
@@ -33,6 +33,7 @@ assert_needs release '[image, promote]'
 job_block release | grep -Fq 'gh release create'
 job_block promote | grep -Fq 'image-release.sh promote-latest'
 job_block chart-publication | grep -Fq 'id-token: write'
+job_block chart-publication | grep -Fq 'actions: read'
 [[ "$(grep -c -- '--rawfile body' .scripts/verify-release-state.sh)" == "1" ]]
 [[ "$(job_block release | grep -c 'verify-release-state.sh')" == "2" ]]
 notes_fixture="$(mktemp)"