diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0f98ecba4..267040aee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,9 @@ jobs:
   call-build-workflow:
     if: startsWith(github.ref, 'refs/tags')
     uses: evcc-io/evcc/.github/workflows/default.yml@master
+    permissions:
+      contents: read
+      actions: write
 
   docker:
     name: Publish Docker :release
@@ -102,7 +105,7 @@ jobs:
       - name: Create Github Release
         uses: goreleaser/goreleaser-action@v6
         with:
-          version: latest
+          version: '~> v2'
           args: release --clean
         env:
           # use RELEASE_DEPLOY_TOKEN for access to evcc-io/homebrew-tap
@@ -154,7 +157,6 @@ jobs:
           repository: evcc-io/hassio-addon
           token: ${{ secrets.HASSIO_DEPLOY_TOKEN }}
           path: ./hassio
-          persist-credentials: false
 
       - name: Update version
         run: |