diff --git a/.github/workflows/TagIt.yml b/.github/workflows/TagIt.yml
index af6d7ff5818..693849e4446 100644
--- a/.github/workflows/TagIt.yml
+++ b/.github/workflows/TagIt.yml
@@ -6,8 +6,13 @@ on:
 
 name: TagIt
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write  # for actions/create-release to create a release
     name: Release
     runs-on: ubuntu-latest
     steps: