diff --git a/README.md b/README.md
index d6c70cb..1718387 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@ No modules.
 | [github_team.developers](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
 | [github_team_membership.admins_xnoto](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership) | resource |
 | [github_team_repository.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_repository) | resource |
+| [github_workflow_repository_permissions.release_automation](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/workflow_repository_permissions) | resource |
 | [github_app.chart_updater](https://registry.terraform.io/providers/integrations/github/latest/docs/data-sources/app) | data source |
 | [sops_file.secret_vars](https://registry.terraform.io/providers/carlpett/sops/latest/docs/data-sources/file) | data source |
 
diff --git a/gh-workflow-permissions.tf b/gh-workflow-permissions.tf
new file mode 100644
index 0000000..7584578
--- /dev/null
+++ b/gh-workflow-permissions.tf
@@ -0,0 +1,8 @@
+# Release Please uses the repository-scoped GITHUB_TOKEN to create its release
+# pull request after successful main CI. Keep the default token read-only; the
+# release workflow requests only the write scopes it needs at job level.
+resource "github_workflow_repository_permissions" "release_automation" {
+  repository                       = github_repository.repositories["terraform-libvirt-domain"].name
+  default_workflow_permissions     = "read"
+  can_approve_pull_request_reviews = true
+}