diff --git a/.github/workflows/dev_build.yml b/.github/workflows/dev_build.yml
index a53fece..2f30650 100644
--- a/.github/workflows/dev_build.yml
+++ b/.github/workflows/dev_build.yml
@@ -5,6 +5,10 @@ on:
     branches:
       - '**'
 
+permissions:
+  # Required for the snapshot release step; the repo's default token is read-only.
+  contents: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4cad61a..d6f2364 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,8 +36,12 @@ jobs:
         uses: gradle/actions/setup-gradle@v6
 
       - name: Build with Gradle
+        # Tags up to v1.3.5 were committed with gradlew at mode 100644 (no exec bit),
+        # so make it runnable before invoking it.
         # Override the Windows JDK path pinned in gradle.properties with the runner's JDK 21.
-        run: ./gradlew build -Dorg.gradle.java.home="$JAVA_HOME"
+        run: |
+          chmod +x ./gradlew
+          ./gradlew build -Dorg.gradle.java.home="$JAVA_HOME"
 
       - name: Publish Release
         uses: softprops/action-gh-release@v3