diff --git a/.github/workflows/binary.yml b/.github/workflows/binary.yml
index 3bf7464..7fdd823 100644
--- a/.github/workflows/binary.yml
+++ b/.github/workflows/binary.yml
@@ -32,6 +32,11 @@ on:
     types: [published]
   workflow_dispatch:
 
+# The upload step attaches assets to the existing release; public repos
+# default GITHUB_TOKEN to read-only, so contents:write is explicit.
+permissions:
+  contents: write
+
 jobs:
   build:
     strategy: