diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index da8a3db0ac..2ce2c50033 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -59,6 +59,8 @@ jobs:
 
   static-scan:
     needs: [pre-publish]
+    permissions:
+      security-events: write
     uses: ./.github/workflows/codeql.yml
     with:
       ref: ${{ needs.pre-publish.outputs.version }}