diff --git a/.github/workflows/release-template.yml b/.github/workflows/release-template.yml
index fd6b2064..e38695cb 100644
--- a/.github/workflows/release-template.yml
+++ b/.github/workflows/release-template.yml
@@ -11,9 +11,6 @@ jobs:
   release:
     name: Upload Release Asset
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
     steps:
       - id: secrets
         uses: SonarSource/vault-action-wrapper@3.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c9ae11c4..8232205d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,9 @@ jobs:
   release-9-x:
     name: Upload Release Assets for 9-X releases
     if: contains(github.event.release.name, '9.')
+    permissions:
+      contents: write
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -24,6 +27,9 @@ jobs:
   release-10-x:
     name: Upload Release Assets for 10-X releases
     if: contains(github.event.release.name, '10.')
+    permissions:
+      contents: write
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -38,6 +44,9 @@ jobs:
   release-community-build:
     name: Upload Release Assets for community-build release
     if: contains(github.event.release.name, 'Community Build')
+    permissions:
+      contents: write
+      id-token: write
     strategy:
       fail-fast: false
       matrix: