diff --git a/.github/workflows/check_pr_release_notes.yml b/.github/workflows/check_pr_release_notes.yml
index 3e10169..b899955 100644
--- a/.github/workflows/check_pr_release_notes.yml
+++ b/.github/workflows/check_pr_release_notes.yml
@@ -5,6 +5,10 @@ on:
     types: [opened, synchronize, reopened, edited, labeled, unlabeled]
     branches: [ master ]
 
+concurrency:
+  group: release-notes-check-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check-release-notes:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release_draft.yml b/.github/workflows/release_draft.yml
index f9f8f10..b0f09ea 100644
--- a/.github/workflows/release_draft.yml
+++ b/.github/workflows/release_draft.yml
@@ -11,6 +11,11 @@ on:
           Default value: latest tag. Syntax: "v[0-9]+.[0-9]+.[0-9]+".
         required: false
 
+permissions:
+  contents: write
+  issues: read
+  pull-requests: read
+
 jobs:
   release-draft:
     runs-on: ubuntu-latest
@@ -74,28 +79,13 @@ jobs:
           script: |
             const tag = process.env.TAG_NAME;
             const ref = `refs/tags/${tag}`;
-            const sha = context.sha; // The SHA of the commit to tag
-            const tagMessage = `${tag} released by GitHub Action`;
-
-            const tagObject = await github.rest.git.createTag({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              tag: tag,
-              message: tagMessage,
-              object: sha,
-              type: 'commit',
-              tagger: {
-                name: context.actor,
-                email: `${context.actor}@users.noreply.github.com`,
-                date: new Date().toISOString()
-              }
-            });
+            const sha = context.sha;
 
             await github.rest.git.createRef({
               owner: context.repo.owner,
               repo: context.repo.repo,
               ref: ref,
-              sha: tagObject.data.sha
+              sha: sha
             });
 
             console.log(`Tag created: ${tag}`);