diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 74dca28..3123514 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-name: Create Release
+name: Release
 
 on:
   pull_request:
@@ -6,6 +6,11 @@ on:
     branches:
       - main
 
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
 jobs:
   create-release:
     name: Create Release
@@ -21,8 +26,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Determine Next Version
+      - name: Determine Version
         id: version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Get latest release tag (if any)
           latest_tag=$(gh release view --json tagName --jq .tagName || echo "v0.0.0")
@@ -39,11 +46,12 @@ jobs:
           fi
           
           # Determine version bump type from PR labels
-          if contains(github.event.pull_request.labels.*.name, 'major'); then
+          labels="${{ toJSON(github.event.pull_request.labels.*.name) }}"
+          if echo "$labels" | jq -e 'contains(["major"])' > /dev/null; then
             major=$((major + 1))
             minor=0
             patch=0
-          elif contains(github.event.pull_request.labels.*.name, 'minor'); then
+          elif echo "$labels" | jq -e 'contains(["minor"])' > /dev/null; then
             minor=$((minor + 1))
             patch=0
           else
@@ -54,8 +62,6 @@ jobs:
           new_version="v${major}.${minor}.${patch}"
           echo "New version will be: $new_version"
           echo "version=$new_version" >> $GITHUB_OUTPUT
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate Release Notes
         id: release-notes