diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
index e49d9e2..0bcfc78 100644
--- a/.github/workflows/create-release-pr.yaml
+++ b/.github/workflows/create-release-pr.yaml
@@ -12,6 +12,8 @@ on:
         description: "Token to create the pull request"
         required: true
 
+permissions: {}
+
 jobs:
   debug_info:
     name: Debug info
@@ -124,6 +126,8 @@ jobs:
   prepare_release_pr:
     name: Prepare release PR for Backstage project
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     needs:
       - gather_facts
     if: ${{ needs.gather_facts.outputs.skip != 'true' && github.repository == 'giantswarm/backstage' }}
@@ -161,6 +165,8 @@ jobs:
   create_release_pr:
     name: Create release PR
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     needs:
       - gather_facts
       - prepare_release_pr
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 37d3ca2..a8f55ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-01-23
+
+### Changed
+
+- Restrict permissions for GITHUB_TOKEN in "Create Release PR" workflow.
+
 ## 2026-01-16
 
 ### Changed