diff --git a/.github/workflows/create-release-branch.yml b/.github/workflows/create-release-branch.yml
index 1428c92b6..b2e06d7a4 100644
--- a/.github/workflows/create-release-branch.yml
+++ b/.github/workflows/create-release-branch.yml
@@ -1,5 +1,12 @@
 name: Create a release branch
 on: [workflow_dispatch]
+
+# The actions-create-release-branch step uses secrets.ELEVATED_GITHUB_TOKEN
+# to push the release branch; the default GITHUB_TOKEN only needs read
+# access for the checkout.
+permissions:
+  contents: read
+
 jobs:
   create-branch:
     runs-on: ubuntu-latest