diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d568f74..1690f4f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,12 @@ on:
   release:
     types: [published]
 
+# Default GITHUB_TOKEN is read-only; the build job's "Upload to Release" step
+# needs contents:write to attach the built zip as a release asset (else HTTP 403
+# "Resource not accessible by integration").
+permissions:
+  contents: write
+
 jobs:
   test:
     runs-on: windows-latest