diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2fc2945..2236ee7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,9 +10,11 @@ env:
 
 jobs:
   release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - name: publish library
       run: cargo publish  --verbose --token ${CARGO_REGISTRY_TOKEN}
       env: