diff --git a/.github/workflows/auto-release.yaml b/.github/workflows/auto-release.yaml
index b6bf69c..d58df37 100644
--- a/.github/workflows/auto-release.yaml
+++ b/.github/workflows/auto-release.yaml
@@ -1,12 +1,20 @@
 name: Autorelease
+# pull_request_target (and not pull_request) because this job writes through the
+# GitHub API, and GITHUB_TOKEN is read-only for pull_request runs from forks.
+# This job never checks out or runs code from the PR, only its metadata.
 on:
-  pull_request:
+  pull_request_target:
     types:
       - synchronize
       - labeled
       - unlabeled
       - closed
 
+permissions:
+  contents: write
+  issues: write
+  actions: write
+
 jobs:
   create-release-tag:
     runs-on: ubuntu-latest