diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 60b6065..6ff4ce0 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -6,8 +6,9 @@ on:
     tags: ["v*"]
   pull_request:
 
+# Every job gets a read-only token; only `release` publishes (it sets `contents: write` itself).
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build:
@@ -72,6 +73,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: [build, smoke]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # gh release create
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6