diff --git a/.github/workflows/crates-io.yml b/.github/workflows/crates-io.yml
index 5fcebf7..34b4b8f 100644
--- a/.github/workflows/crates-io.yml
+++ b/.github/workflows/crates-io.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
       - name: Publish binaries
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9b53c07..312007a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,7 +2,7 @@ name: Release
 
 on:
   release:
-    types: [published]
+    types: [created, published]
   push:
     branches: [master]
   pull_request:
@@ -15,6 +15,11 @@ jobs:
   release:
     name: Release for ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+
+    # Explicitly grant GITHUB_TOKEN write access to attach binaries to the release
+    permissions:
+      contents: write
+    
     strategy:
       matrix:
         include:
@@ -29,11 +34,13 @@ jobs:
             os_name: "macos-amd64"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Get tag or commit
         run: |
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+          if [ "${{ github.event_name }}" = "release" ]; then
+            echo "RELEASE_VERSION=${{ github.event.release.tag_name }}" >> $GITHUB_ENV
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
             echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
           else
             SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
@@ -64,4 +71,5 @@ jobs:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: release.tar.gz
           asset_name: ${{ env.REPO }}-${{ env.RELEASE_VERSION }}-${{ matrix.os_name }}.tar.gz
-          tag: ${{ github.ref }}
+          tag: ${{ github.event.release.tag_name }}
+          overwrite: true
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ad86a6b..5866ee2 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install stable toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install stable toolchain
         uses: dtolnay/rust-toolchain@stable
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a00979..94dc76f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [unreleased] - Next Date
 
+### Changed
+
+- Grant github release workflow permission to write binaries
+
 
 ## [0.8.1] - 2026-10-25