diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 620fbd1ca..3e9315be1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -100,7 +100,7 @@ jobs:
             sed -i -E "s/(\"version\": \")[^\"]+(\")/\1$VERSION\2/" "$f"
           done
           git add -A
-          git commit -m "chore: sync release version $VERSION to staging [skip ci]" \
+          git commit -m "chore(*): sync release version $VERSION to staging [skip ci]" \
             || { echo "Staging already at $VERSION, nothing to sync"; exit 0; }
           git push -f origin $BRANCH
           gh pr create \
@@ -165,6 +165,12 @@ jobs:
     needs: [release]
     runs-on: ubuntu-latest
 
+    # GITHUB_TOKEN needs packages:write to push to GHCR. Declaring the block
+    # sets every unlisted scope to none, so contents:read is required for checkout.
+    permissions:
+      contents: read
+      packages: write
+
     outputs:
       image: ${{ steps.build.outputs.image }}
 
diff --git a/package.json b/package.json
index 35de3afb9..cae35ca6e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "kotahi",
-  "version": "2026.09.01-0",
+  "version": "2026.09.02-0",
   "private": true,
   "description": "Kotahi - open journals",
   "repository": {
diff --git a/packages/client/package.json b/packages/client/package.json
index 30f8ca9ef..4d84e9017 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "kotahi",
-  "version": "2026.09.01-0",
+  "version": "2026.09.02-0",
   "private": true,
   "description": "Kotahi - open journals",
   "repository": {
diff --git a/packages/server/package.json b/packages/server/package.json
index 26d82072a..ce37a05f9 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "kotahi",
-  "version": "2026.09.01-0",
+  "version": "2026.09.02-0",
   "private": true,
   "description": "Kotahi - open journals",
   "repository": {