diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1da8c65019..2f84893e5b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,12 +1,6 @@
 name: Publish Release
 run-name: "Publish release from ${{ github.ref_name }} branch"
 
-permissions:
-  # Needed to push the tag.
-  contents: write
-  # Needed to close the milestone.
-  issues: write
-
 on:
   workflow_dispatch:
     inputs:
@@ -39,6 +33,12 @@ on:
         description: "Automatically set by the return-dispatch action (leave blank if running manually)"
         required: false
 
+permissions:
+  # Needed to push the tag.
+  contents: write
+  # Needed to close the milestone.
+  issues: write
+
 jobs:
   publish:
     runs-on: ubuntu-latest