diff --git a/.github/scripts/release-tag.test.sh b/.github/scripts/release-tag.test.sh
index 337db7c..425944a 100755
--- a/.github/scripts/release-tag.test.sh
+++ b/.github/scripts/release-tag.test.sh
@@ -172,4 +172,15 @@ else
   fails=$((fails + 1))
 fi
 
+# workflows: write lets GitHub create a tag at a commit whose workflow tree matches no branch tip.
+token='.jobs.mint.steps[] | select(.name == "Create scoped release App token") | .with'
+if [ "$(yq -r "$token | keys | map(select(test(\"^permission-\"))) | sort | join(\",\")" "$workflow")" = permission-contents,permission-workflows ] \
+  && [ "$(yq -r "$token | .\"permission-contents\"" "$workflow")" = write ] \
+  && [ "$(yq -r "$token | .\"permission-workflows\"" "$workflow")" = write ]; then
+  echo 'ok   mint token has contents and workflows write only'
+else
+  echo 'FAIL mint token has contents and workflows write only'
+  fails=$((fails + 1))
+fi
+
 [ "$fails" -eq 0 ]
diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml
index 2d70813..19e4226 100644
--- a/.github/workflows/release-tag.yaml
+++ b/.github/workflows/release-tag.yaml
@@ -52,6 +52,7 @@ jobs:
           client-id: ${{ vars.AUTOMATION_APP_CLIENT_ID }}
           private-key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
           permission-contents: write
+          permission-workflows: write
           repositories: nix2container
 
       - name: Mint release tag if needed