diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5b31be1..386fe7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -115,10 +115,14 @@ jobs:
       - run: mix test
 
   draft-release:
+    if: github.event_name == 'push'
     runs-on: ubuntu-24.04
     needs:
       - static-analysis
       - tests
+    permissions:
+      contents: write
+      pull-requests: read
     outputs:
       tag_name: ${{ steps.release_drafter.outputs.tag_name }}
     steps:
@@ -130,10 +134,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   build-release-nifs:
+    if: github.event_name == 'push'
     name: NIF ${{ matrix.nif }} - ${{ matrix.target }} (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     needs:
       - draft-release
+    permissions:
+      contents: write
     defaults:
       run:
         working-directory: "./native/wireguard_nif"