diff --git a/.github/workflows/release-sign.yml b/.github/workflows/release-sign.yml
index 349956b..a39e45d 100644
--- a/.github/workflows/release-sign.yml
+++ b/.github/workflows/release-sign.yml
@@ -22,10 +22,8 @@ on:
     types: [published]
 
 permissions:
-  contents: write
-  id-token: write
-  repository-projects: write
-  
+  contents: read
+
 jobs:
   release:
     name: Sign & upload release artifacts
@@ -34,6 +32,11 @@ jobs:
     env:
        TAG: ${{ github.ref_name }}
        
+    permissions:
+      contents: write
+      id-token: write
+      repository-projects: write
+
     steps:
 
       - name: Set Prefix