diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 3e8a8774..f98b2989 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -10,6 +10,9 @@ jobs:
   release-plz:
     name: Release-plz
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -24,17 +27,12 @@ jobs:
       - name: Run release-plz
         id: release-plz
         uses: MarcoIeni/release-plz-action@v0.5
-        permissions:
-          pull-requests: write
-          contents: write
         env:
           GITHUB_TOKEN: ${{ secrets.OXC_BOT_PAT }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
       - name: Bump package.json
         if: ${{ steps.release-plz.outputs.prs_created }}
-        permissions:
-          pull-requests: write
         env:
           GH_TOKEN: ${{ secrets.OXC_BOT_PAT }}
           RELEASES: ${{ steps.release-plz.outputs.releases }}