diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c770669..e4fe665 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,6 +15,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -37,12 +39,18 @@ jobs:
   publish:
     needs: test
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
+      # The repo ruleset requires PRs for GITHUB_TOKEN pushes to main.
+      # Checking out with the repo Deploy Key (SSH) makes the version-bump
+      # push below bypass the ruleset, same as api/console/chat release.yml.
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: main
+          ssh-key: ${{ secrets.DEPLOY_KEY }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4