diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 2e65ce9f..66ea4ec8 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -124,6 +124,10 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
+    # R115: GITHUB_TOKEN 默认无 contents:write → softprops/action-gh-release
+    # 创建 release 403（Resource not accessible by integration）。
+    permissions:
+      contents: write
     steps:
       - uses: actions/download-artifact@v4
         with: