diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 92f9573f1e..5b13be059e 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -6,8 +6,7 @@ on:
       - "mcp-v*.*.*"
 
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 
 concurrency:
   group: npm-publish-${{ github.ref_name }}
@@ -16,12 +15,16 @@ concurrency:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
@@ -67,6 +70,13 @@ jobs:
       - name: Publish with npm trusted publishing
         run: npx -y npm@11.15.0 publish --workspace @jsonbored/gittensory-mcp --access public --provenance
 
+  github-release:
+    runs-on: ubuntu-latest
+    needs: publish
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}