diff --git a/.github/workflows/android-play-signature-audit.yml b/.github/workflows/android-play-signature-audit.yml
index 7c4f90dd..3a500dd8 100644
--- a/.github/workflows/android-play-signature-audit.yml
+++ b/.github/workflows/android-play-signature-audit.yml
@@ -9,7 +9,8 @@ on:
         type: string
 
 permissions:
-  contents: read
+  # Draft Releases are only visible to a token with repository write access.
+  contents: write
 
 jobs:
   audit:
diff --git a/scripts/store-delivery.test.mjs b/scripts/store-delivery.test.mjs
index 6b8f0dc3..3b689313 100644
--- a/scripts/store-delivery.test.mjs
+++ b/scripts/store-delivery.test.mjs
@@ -72,6 +72,7 @@ describe("store delivery command", () => {
     );
 
     expect(workflow).toContain("github.repository == 'tianma-if/edgeever'");
+    expect(workflow).toContain("permissions:\n  # Draft Releases are only visible to a token with repository write access.\n  contents: write");
     expect(workflow).toContain('gh release view "$RELEASE_TAG"');
     expect(workflow).toContain('test "$(jq -r \'.isDraft\' <<<"$release")" = "true"');
     expect(workflow).toContain("ref: ${{ steps.release.outputs.target_commitish }}");