diff --git a/.github/workflows/publish-python.yml b/.github/workflows/publish-python.yml
index c91e6ae..9ca98f9 100644
--- a/.github/workflows/publish-python.yml
+++ b/.github/workflows/publish-python.yml
@@ -20,6 +20,10 @@ concurrency:
 
 jobs:
   select:
+    # Draft releases require push access to be visible in the releases API.
+    permissions:
+      contents: write
+      actions: read
     if: github.repository == 'wavefnd/hmath' && github.ref == 'refs/heads/master'
     runs-on: ubuntu-24.04
     outputs: