diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 5469c16..27cc315 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -52,5 +52,10 @@ jobs:
     with:
       tag_name: ${{ needs.tag.outputs.new-tag-version }}
     if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major'
+    # Must cover every permission release.yml declares: a called workflow
+    # cannot exceed its caller's grant, and the mismatch fails the dispatch
+    # at startup with no jobs or logs.
     permissions:
       contents: write # allow create release
+      id-token: write # attest provenance
+      attestations: write # attest provenance