diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ca3ef60..b7d3cd7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -8,6 +8,9 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
@@ -41,8 +44,9 @@ jobs:
         if: ${{ steps.versioning.outputs.should_release == 'true' }}
         run: gh release create ${{ steps.versioning.outputs.package_version }} --generate-notes
         env:
-          GITHUB_TOKEN: ${{ secrets.gh_token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Build & Publish package
         if: ${{ steps.versioning.outputs.should_release == 'true' }}
         run: |
           uv build
+          uv publish