diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 91ef3ef0a..6cedde684 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -10,11 +10,12 @@ on:
 
 permissions:
   contents: read
-  actions: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Checkout release tag
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4af57e0f..a22c7c34b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,16 +66,24 @@ jobs:
           ## Install
 
           \`\`\`bash
-          uv tool install specify-cli==${VERSION_NO_V}
+          uv tool install specify-cli@latest
           specify init my-project
           \`\`\`
 
+          Or pin to this exact release:
+
+          \`\`\`bash
+          uv tool install specify-cli==${VERSION_NO_V}
+          \`\`\`
+
           Or install from source:
 
           \`\`\`bash
           uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION}
           \`\`\`
 
+          > **Note:** PyPI publishing runs shortly after this release is created. If the PyPI version is not yet available, use the source install command above.
+
           NOTES_EOF
 
           echo "## What's Changed" >> release_notes.md