diff --git a/.github/workflows/publish_v3_layer.yml b/.github/workflows/publish_v3_layer.yml
index 55571500889..d27031af366 100644
--- a/.github/workflows/publish_v3_layer.yml
+++ b/.github/workflows/publish_v3_layer.yml
@@ -303,7 +303,7 @@ jobs:
     needs: [update_v3_layer_arn_docs, prepare_docs_alias]
     permissions:
       # lower privilege propagated from parent workflow (release.yml)
-      #contents: write
+      contents: read
       #pages: write
       pull-requests: none
       id-token: write