diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8c93af43..497a899c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,7 @@ permissions:
   actions: read
   contents: read
   security-events: read
+  vulnerability-alerts: read
   attestations: write
   id-token: write
 
diff --git a/scripts/verify-release-workflow-test.sh b/scripts/verify-release-workflow-test.sh
index 878245a7..c9574b19 100644
--- a/scripts/verify-release-workflow-test.sh
+++ b/scripts/verify-release-workflow-test.sh
@@ -34,6 +34,7 @@ permissions:
   actions: read
   contents: read
   security-events: read
+  vulnerability-alerts: read
   attestations: write
   id-token: write
 jobs:
@@ -88,6 +89,10 @@ cat >> "${complete_workflow}" <<'YAML'
 YAML
 assert_accepts "${complete_workflow}"
 
+missing_vulnerability_alerts_permission_workflow="${temp_dir}/missing-vulnerability-alerts-permission-release.yml"
+grep -v "vulnerability-alerts: read" "${complete_workflow}" > "${missing_vulnerability_alerts_permission_workflow}"
+assert_rejects "${missing_vulnerability_alerts_permission_workflow}"
+
 missing_alert_workflow="${temp_dir}/missing-alert-release.yml"
 grep -v "Verify Dependabot security alerts\|dependabot/alerts" "${safe_workflow}" > "${missing_alert_workflow}"
 assert_rejects "${missing_alert_workflow}"
diff --git a/scripts/verify-release-workflow.sh b/scripts/verify-release-workflow.sh
index 5aebc6b5..b17b898c 100644
--- a/scripts/verify-release-workflow.sh
+++ b/scripts/verify-release-workflow.sh
@@ -39,6 +39,7 @@ require_text "-Prelease -DskipTests deploy"
 require_text "Verify Dependabot security alerts"
 require_text "dependabot/alerts"
 require_text "security-events: read"
+require_text "vulnerability-alerts: read"
 require_text "attestations: write"
 require_text "id-token: write"
 require_text "actions/attest-build-provenance"